b1a636c93c714a4aac6ff70a6d675623_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

b1a636c93c714a4aac6ff70a6d675623_JaffaCakes118
Size

1.1MB
MD5

b1a636c93c714a4aac6ff70a6d675623
SHA1

6eab56beb946edcd6616c60a2ad639089aa6203f
SHA256

91937e15cc3498124ae6214311863d71ffd91110655b97f56d260b8d68707554
SHA512

6c09e8371a87fe86d8a1265abd1b7214d8c9614c8c8a9e9efc5415ce38de248322296e4ed9244576040c96c29200db619b50f25f0bad8c30b089f3d9751db042
SSDEEP

24576:PaQykf7J/J4VkdRBg0MkUCHjF9PfFjp5kk:1DJ/J4LfMzPfFTkk

Score

1^/10

Malware Config

Signatures

Files

b1a636c93c714a4aac6ff70a6d675623_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

04f0e51b940e595b229ee580fd34043d

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:5f:b0:bc:f6:39:3d:78:76:18:2f:a4:fc:94:b7:77
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

06/12/2007, 00:00

Not After

14/12/2008, 23:59

Subject

CN=SmartShopper Software Development Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=SmartShopper Software Development Ltd.,ST=Tel-Aviv,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\dvlp\vs7.hb5\client\app\SmartShopper\bin\ShoppingReport.pdb

Imports

kernel32

CompareStringA
GetModuleHandleA
GetWindowsDirectoryA
GetSystemDirectoryA
SetLastError
GetCurrentProcessId
DeleteCriticalSection
InitializeCriticalSection
GetDriveTypeA
CreateDirectoryA
SetCurrentDirectoryA
GetCurrentDirectoryA
VirtualQuery
GetModuleFileNameA
LoadLibraryA
HeapReAlloc
lstrlenA
WaitForSingleObject
GetTickCount
LocalAlloc
LockResource
LoadResource
SizeofResource
FreeLibrary
InterlockedDecrement
InterlockedIncrement
GetLastError
SetEnvironmentVariableA
SetConsoleCtrlHandler
SetStdHandle
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
IsBadCodePtr
IsBadReadPtr
GetOEMCP
GetTimeZoneInformation
GetDateFormatA
GetTimeFormatA
UnhandledExceptionFilter
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
RaiseException
GetCurrentThreadId
SetHandleCount
LCMapStringA
TerminateProcess
TlsGetValue
TlsSetValue
TlsFree
TlsAlloc
QueryPerformanceCounter
FatalAppExitA
VirtualFree
HeapCreate
GetLocalTime
GetCommandLineA
GetSystemInfo
VirtualAlloc
VirtualProtect
RtlUnwind
GetSystemTimeAsFileTime
ExitProcess
HeapSize
HeapDestroy
GetVersionExA
MoveFileExW
CreateFileA
DeleteFileA
GetSystemDefaultLangID
GlobalHandle
GlobalFree
PulseEvent
ReleaseSemaphore
WriteFile
ReadFile
FlushFileBuffers
SetFilePointer
GetFileSize
SetEndOfFile
CreateThread
TerminateThread
SetThreadPriority
ResumeThread
GetCurrentThread
IsBadWritePtr
SetUnhandledExceptionFilter
MulDiv
GlobalAlloc
GlobalLock
GlobalUnlock
GetFileTime
SystemTimeToFileTime
SetFileTime
Sleep
FindClose
GetSystemTime
FileTimeToSystemTime
GetExitCodeProcess
WaitForMultipleObjects
MapViewOfFile
UnmapViewOfFile
ResetEvent
SetEvent
ReleaseMutex
CloseHandle
LocalFree
HeapAlloc
GetProcessHeap
HeapFree
GetCurrentProcess
FlushInstructionCache
LeaveCriticalSection
GetStdHandle
EnterCriticalSection
GetThreadLocale
GetLocaleInfoA
GetACP
GetFileType
InterlockedExchange
GetFullPathNameA

advapi32

RegCloseKey

user32

MapWindowPoints
BringWindowToTop
GetKeyState
ReplyMessage
GetTopWindow
UpdateWindow
MsgWaitForMultipleObjects
TranslateMessage
RedrawWindow
GetDlgItem
EnumChildWindows
IsChild
SetFocus
BeginPaint
KillTimer
DestroyWindow
OffsetRect
InflateRect
ShowWindow
IsWindow
GetParent
CopyRect
MoveWindow
EqualRect
EndPaint
GetWindowRect
IsIconic
IsWindowVisible
SetTimer
GetFocus
GetSysColor
GetDesktopWindow
SetWindowRgn
UnregisterClassA
EnumWindows
SetRectEmpty
GetSysColorBrush
InvalidateRgn
InvalidateRect
ReleaseDC
GetDC
SetWindowPos
SetWindowContextHelpId
MapDialogRect
GetWindow
DestroyAcceleratorTable
ReleaseCapture
SetCapture
FillRect
GetClientRect

gdi32

DeleteObject
DeleteDC
CreateCompatibleBitmap
CreateCompatibleDC
GetStockObject
BitBlt
GetDeviceCaps
CreateSolidBrush
CreateRectRgn
CombineRgn
CreatePolygonRgn
CreateRoundRectRgn
OffsetRgn
FillRgn
SelectObject

sensapi

IsNetworkAlive

version

GetFileVersionInfoW
GetFileVersionInfoSizeA
GetFileVersionInfoSizeW
VerQueryValueW
VerQueryValueA
GetFileVersionInfoA

iphlpapi

GetAdaptersInfo

ole32

CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
StringFromGUID2
StringFromCLSID
CoCreateGuid
CoCreateInstance
ProgIDFromCLSID
CreateStreamOnHGlobal
OleInitialize
OleUninitialize
CoGetClassObject
CLSIDFromProgID
CLSIDFromString
OleRun
CoUninitialize
CoInitialize
CoMarshalInterface
CoReleaseMarshalData
CoUnmarshalInterface
OleLockRunning

oleaut32

SysAllocString
SysFreeString
SysStringLen
SysAllocStringByteLen
SysStringByteLen
VarBstrCat
SysAllocStringLen
VarUI4FromStr
LoadRegTypeLi
LoadTypeLi
VariantClear
DispCallFunc
VariantInit
VariantChangeType
UnRegisterTypeLi
RegisterTypeLi
GetErrorInfo
SetErrorInfo
CreateErrorInfo
OleCreateFontIndirect
VariantCopy
VarBstrCmp
SafeArrayLock
SafeArrayUnlock
SafeArrayGetDim
SafeArrayGetElement
SafeArrayCreateVector
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayPutElement
VarUdateFromDate
SafeArrayGetVartype
BstrFromVector
VectorFromBstr
VariantTimeToSystemTime
SystemTimeToVariantTime
SafeArrayCopy
SafeArrayDestroy
SafeArrayCreate
SafeArrayGetLBound
SafeArrayGetUBound

shlwapi

StrToIntW
StrRChrW
PathFileExistsW
PathFindExtensionW

urlmon

CreateURLMoniker

ws2_32

WSASocketW
closesocket
WSAStartup
WSACreateEvent
WSASetEvent
WSARecv
WSAResetEvent
WSASend
WSAGetOverlappedResult
WSAConnect
WSAGetLastError
WSAEnumNetworkEvents
WSACloseEvent
WSACleanup
GetAddrInfoW
FreeAddrInfoW
WSAEventSelect

comctl32

ImageList_ReplaceIcon
_TrackMouseEvent
ord17
ImageList_GetImageCount

crypt32

CryptMsgGetParam
CertGetNameStringW
CryptMsgClose
CertCloseStore
CertFreeCertificateContext
CryptQueryObject
CertFindCertificateInStore

shell32

SHCreateDirectoryExW
SHGetSpecialFolderPathW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllSendIdsRequestAbort
DllSendIdsRequestAlreadyInstalled
DllSendIdsRequestCancel
DllSendIdsRequestInstalledOnVista
DllSendIdsRequestOk
DllSendUninstallReport
DllUnregisterServer

Sections

.text
Size: 748KB - Virtual size: 745KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 204KB - Virtual size: 200KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 108KB - Virtual size: 106KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

04f0e51b940e595b229ee580fd34043d

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

61:5f:b0:bc:f6:39:3d:78:76:18:2f:a4:fc:94:b7:77Certificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

PDB Paths

Imports

kernel32

advapi32

user32

gdi32

sensapi

version

iphlpapi

ole32

oleaut32

shlwapi

urlmon

ws2_32

comctl32

crypt32

shell32

Exports

Exports

Sections

.text Size: 748KB - Virtual size: 745KB

.rdata Size: 204KB - Virtual size: 200KB

.data Size: 20KB - Virtual size: 31KB

.rsrc Size: 108KB - Virtual size: 106KB

.reloc Size: 56KB - Virtual size: 55KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

61:5f:b0:bc:f6:39:3d:78:76:18:2f:a4:fc:94:b7:77
Certificate

.text
Size: 748KB - Virtual size: 745KB

.rdata
Size: 204KB - Virtual size: 200KB

.data
Size: 20KB - Virtual size: 31KB

.rsrc
Size: 108KB - Virtual size: 106KB

.reloc
Size: 56KB - Virtual size: 55KB