ad616a7e4a5306582e0f7363e36e0e75_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

ad616a7e4a5306582e0f7363e36e0e75_JaffaCakes118
Size

504KB
MD5

ad616a7e4a5306582e0f7363e36e0e75
SHA1

33c78e3161f1d59aa14005d058844138b6b71913
SHA256

f8ab52e7763d9ba4b56cc6aa575f23115318796d6428c7b91aec92664954cb51
SHA512

911e5ece13c3794e186726893c6165faedd413dda15de48eec1f9962c0c7a59162a10898fe8a64f81149b5247d58573e0094fabed0e5e60af7fb82a8b94f058c
SSDEEP

6144:4j6uVVVQwvMWrgnLa3mQ+89nSfNNhDEJ3/IXGVkzY+E/JqsKXijC5Cr1lZ8fO/7W:fuVVbTr84TWM+gJqsKXij1hlvzW

Score

1^/10

Malware Config

Signatures

Files

ad616a7e4a5306582e0f7363e36e0e75_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

2d595e7acc9cc3b21327a1e5228f7c93

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

39:61:e8:24:57:d3:2f:54:a7:70:a0:98:67:30:31:f5
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

08/02/2006, 00:00

Not After

08/04/2007, 23:59

Subject

CN=WHENU.COM INC,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Department,O=WHENU.COM INC,L=New York,ST=New York,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\Projects\WhenU\Acm\Acm\Release\ACM.pdb

Imports

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

kernel32

LoadResource
FindResourceA
LoadLibraryExA
GetModuleHandleA
DeleteCriticalSection
RaiseException
EnterCriticalSection
InitializeCriticalSection
MultiByteToWideChar
lstrlenA
GetLastError
GetModuleFileNameA
lstrcatA
lstrcpyA
WideCharToMultiByte
lstrlenW
SizeofResource
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
LeaveCriticalSection
InterlockedIncrement
InterlockedDecrement
CompareStringW
GlobalLock
GlobalUnlock
GetProcAddress
SetUnhandledExceptionFilter
GetLocaleInfoW
SetStdHandle
LoadLibraryA
lstrcpynA
lstrcmpiA
IsDBCSLeadByte
FreeLibrary
InterlockedExchange
GetOEMCP
IsBadCodePtr
IsBadReadPtr
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
FlushFileBuffers
WriteFile
UnhandledExceptionFilter
GetEnvironmentStringsW
SetFilePointer
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
QueryPerformanceCounter
CloseHandle
HeapReAlloc
HeapAlloc
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapFree
GetCurrentThreadId
GetCommandLineA
ExitProcess
RtlUnwind
GetCPInfo
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
HeapDestroy
HeapCreate
VirtualFree
IsBadWritePtr
TerminateProcess
GetCurrentProcess
HeapSize
TlsAlloc
SetLastError
TlsFree
TlsSetValue
TlsGetValue

user32

wsprintfA
CharNextA

advapi32

RegQueryInfoKeyA
RegCloseKey
RegDeleteKeyA
RegDeleteValueA
RegCreateKeyExA
RegSetValueExA
RegEnumKeyExA
RegOpenKeyExA

ole32

CoTaskMemAlloc
StringFromGUID2
CoCreateInstance
CreateStreamOnHGlobal
GetHGlobalFromStream
CoTaskMemFree
CoTaskMemRealloc

oleaut32

SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
VarBstrFromR8
VarR8FromStr
VariantClear
VariantInit
LoadRegTypeLi
SysStringLen
SysAllocStringLen
SysFreeString
SysAllocString
UnRegisterTypeLi
RegisterTypeLi
VarUI4FromStr
LoadTypeLi

shlwapi

PathFindExtensionA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 360KB - Virtual size: 358KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 76KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 44KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2d595e7acc9cc3b21327a1e5228f7c93

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88Certificate

Extended Key Usages

Key Usages

39:61:e8:24:57:d3:2f:54:a7:70:a0:98:67:30:31:f5Certificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

PDB Paths

Imports

version

kernel32

user32

advapi32

ole32

oleaut32

shlwapi

Exports

Exports

Sections

.text Size: 360KB - Virtual size: 358KB

.rdata Size: 76KB - Virtual size: 72KB

.data Size: 8KB - Virtual size: 30KB

.rsrc Size: 8KB - Virtual size: 4KB

.reloc Size: 44KB - Virtual size: 40KB

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

39:61:e8:24:57:d3:2f:54:a7:70:a0:98:67:30:31:f5
Certificate

.text
Size: 360KB - Virtual size: 358KB

.rdata
Size: 76KB - Virtual size: 72KB

.data
Size: 8KB - Virtual size: 30KB

.rsrc
Size: 8KB - Virtual size: 4KB

.reloc
Size: 44KB - Virtual size: 40KB