b49bd0ab0058b88530f38cf1572c38d6_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

b49bd0ab0058b88530f38cf1572c38d6_JaffaCakes118
Size

208KB
MD5

b49bd0ab0058b88530f38cf1572c38d6
SHA1

0c8294c8e8e71d4bb91a5f4e60f51a69eba1eda1
SHA256

f2925e59fff19a8e04ea638c99d5a9964146cbb59379ca977bbd0ff66bc2653e
SHA512

2888ac61446a0ac4204ebb640628d756e295bbc78fce4e7bc2dd3227c9acd4702c62d0a41f0c19659786698d1a58481b75d9cfc069ce2318bb7a8944349ce737
SSDEEP

6144:BENNBzSe7TtsRziJ5KOtMw7FVyWtQg+s8pSPoZK:BENNpSampiZtjfyWtQgJ8pSPo

Score

1^/10

Malware Config

Signatures

Files

b49bd0ab0058b88530f38cf1572c38d6_JaffaCakes118
.dll windows:5 windows x86 arch:x86

5871c7a87dd21577bcee04ed7f9dc55f

Code Sign

63:de:e7:d2:c4:07:e6:65:b5:95:d3:06:d6:56:3e:f8
Certificate

Issuer

CN=CKiGkXE9PDeM

Not Before

15/03/2012, 09:12

Not After

31/12/2039, 23:59

Subject

CN=CKiGkXE9PDeM

Extended Key Usages

ExtKeyUsageCodeSigning

19:d4:98:19:33:24:88:48:ef:2f:ed:ae:86:d6:d6:16:68:d0:0d:be
Signer

Actual PE Digest

19:d4:98:19:33:24:88:48:ef:2f:ed:ae:86:d6:d6:16:68:d0:0d:be

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CancelTimerQueueTimer
BackupSeek
AddAtomW
lstrcpyW
ConnectNamedPipe
lstrlenA
lstrcpyA
CreateFileA
ExitProcess
CopyFileA
CreateFileW
CreateMutexW
CreateToolhelp32Snapshot
DebugActiveProcess
DebugBreak
DeleteCriticalSection
DisconnectNamedPipe
DnsHostnameToComputerNameW
EnterCriticalSection
EnumDateFormatsA
EnumUILanguagesA
lstrcatW
WaitForSingleObject
WaitForDebugEvent
VirtualProtect
VirtualAllocEx
VerifyVersionInfoW
VerifyVersionInfoA
VerLanguageNameA
UpdateResourceW
TlsGetValue
SuspendThread
SleepEx
SignalObjectAndWait
SetTimerQueueTimer
SetThreadIdealProcessor
SetProcessPriorityBoost
SetFileAttributesA
SetDefaultCommConfigW
VirtualAlloc
SetConsoleMode
SetConsoleCP
SetComputerNameW
SetCommTimeouts
SetCommState
RtlFillMemory
ResetWriteWatch
RequestDeviceWakeup
ReplaceFileA
ReleaseMutex
OpenWaitableTimerA
OpenSemaphoreA
MultiByteToWideChar
Module32NextW
Module32Next
MapViewOfFileEx
LocalReAlloc
LocalLock
LocalHandle
LocalFlags
LoadLibraryExW
LoadLibraryExA
LCMapStringW
IsProcessorFeaturePresent
IsBadReadPtr
IsBadHugeWritePtr
InterlockedCompareExchange
InitAtomTable
HeapWalk
HeapLock
HeapCreate
HeapAlloc
GlobalUnfix
GlobalGetAtomNameA
GlobalFindAtomW
GetVolumePathNameW
GetVolumePathNameA
GetVersionExW
GetUserDefaultLCID
GetTempPathW
GetProcessHeaps
GetProcessHeap
GetPrivateProfileStructW
GetPrivateProfileSectionNamesW
GetPrivateProfileIntA
GetNumberOfConsoleMouseButtons
GetLocaleInfoW
GetEnvironmentVariableW
GetEnvironmentVariableA
GetEnvironmentStringsW
GetDiskFreeSpaceA
GetCurrentConsoleFont
GetConsoleOutputCP
GetCommandLineW
GetCommModemStatus
GetCommMask
FoldStringA
FindResourceExW
FindNextFileW
FindFirstChangeNotificationW
FindFirstChangeNotificationA
FindClose
FindAtomW
GetWindowsDirectoryA
FatalAppExitA

user32

wvsprintfA
mouse_event
keybd_event
WindowFromPoint
WindowFromDC
WINNLSGetIMEHotkey
UnpackDDElParam
TabbedTextOutA
SwitchDesktop
ShowOwnedPopups
ShowCaret
SetWindowRgn
SetWindowPos
SetWinEventHook
SetScrollPos
SetParent
SetForegroundWindow
SetClassLongW
SendMessageTimeoutW
SendMessageA
ScrollWindowEx
ScreenToClient
RemoveMenu
RealGetWindowClassA
RealGetWindowClass
PaintDesktop
NotifyWinEvent
LoadKeyboardLayoutW
LoadKeyboardLayoutA
LoadImageA
LoadBitmapA
IsMenu
IsIconic
IsDialogMessage
IsClipboardFormatAvailable
InvalidateRect
InflateRect
IMPSetIMEW
GetWindowTextLengthW
GetWindowPlacement
GetWindow
GetUserObjectInformationW
GetScrollPos
GetNextDlgTabItem
GetMessageA
GetKeyboardType
GetKeyState
GetKeyNameTextW
GetInputState
GetDlgItemTextW
GetDC
GetCursor
GetClipCursor
GetClassWord
GetClassLongW
GetClassInfoExA
GetCaretBlinkTime
GetCapture
FreeDDElParam
FindWindowExA
ExitWindowsEx
EnumThreadWindows
EnumPropsExA
EnumPropsA
EnumDesktopsW
EnableWindow
DrawTextW
DrawIcon
DrawEdge
DlgDirSelectComboBoxExW
DialogBoxParamW
DialogBoxParamA
DestroyIcon
DestroyCaret
DeferWindowPos
DdeInitializeA
CreateDialogIndirectParamA
CreateCursor
CountClipboardFormats
CopyImage
CopyAcceleratorTableA
CloseWindow
ChildWindowFromPoint
CharPrevW
CharLowerW
CharLowerA
CallMsgFilter
BlockInput
ArrangeIconicWindows
AppendMenuA
AnyPopup
AdjustWindowRect
GetWindowTextA

gdi32

EnumFontsA
EngMultiByteToUnicodeN
EngMarkBandingSurface
EngLockSurface
EngLoadModule
EngGetCurrentCodePage
EngDeleteSurface
EngCreateBitmap
EngComputeGlyphSet
EngAlphaBlend
EndFormPage
Ellipse
DeleteObject
CreatePolyPolygonRgn
CreatePen
CreateFontW
CreateFontA
CreateDiscardableBitmap
CreateDIBPatternBrush
CloseMetaFile
CheckColorsInGamut
CancelDC
CLIPOBJ_cEnumStart
BRUSHOBJ_pvAllocRbrush
EnumObjects
Escape
EudcLoadLinkW
ExtEscape
ExtTextOutA
ExtTextOutW
FONTOBJ_pxoGetXform
GdiAddFontResourceW
GdiAddGlsRecord
GdiConvertToDevmodeW
GdiDeleteLocalDC
GdiDeleteSpoolFileHandle
GdiDllInitialize
GdiEndPageEMF
GdiEntry8
GdiFixUpHandle
GdiGetPageCount
GdiGetSpoolFileHandle
GdiPlayScript
GdiQueryFonts
GdiRealizationInfo
GetBitmapBits
GetBoundsRect
GetBrushOrgEx
GetCharABCWidthsFloatW
GetCharABCWidthsI
GetCharacterPlacementA
GetDCPenColor
GetDeviceGammaRamp
GetEUDCTimeStampExW
GetEnhMetaFileDescriptionA
GetFontData
GetLogColorSpaceW
GetMetaFileBitsEx
GetNearestColor
GetNearestPaletteIndex
GetPixel
GetRelAbs
GetStockObject
GetTextCharsetInfo
GetTextColor
GetTextExtentExPointW
GetTextExtentPoint32A
GetTextExtentPointA
HT_Get8BPPMaskPalette
InvertRgn
MirrorRgn
MoveToEx
OffsetRgn
OffsetViewportOrgEx
OffsetWindowOrgEx
PATHOBJ_vEnumStartClipLines
PathToRegion
Pie
PlayEnhMetaFileRecord
PlgBlt
PolyPatBlt
PolyPolygon
QueryFontAssocStatus
RealizePalette
RemoveFontMemResourceEx
ResizePalette
STROBJ_bEnum
SaveDC
SetGraphicsMode
SetMapMode
SetPaletteEntries
SetROP2
SetTextColor
UnrealizeObject
EngStretchBltROP

comdlg32

ChooseColorW
ChooseFontA
ChooseFontW
CommDlgExtendedError
FindTextA
FindTextW
GetFileTitleA
GetFileTitleW
GetOpenFileNameA
ChooseColorA
GetSaveFileNameA
GetSaveFileNameW
PageSetupDlgA
PageSetupDlgW
PrintDlgA
PrintDlgExA
PrintDlgExW
ReplaceTextA
ReplaceTextW
GetOpenFileNameW

advapi32

RegOpenKeyW

Sections

.text
Size: 193KB - Virtual size: 192KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text4
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.text3
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5871c7a87dd21577bcee04ed7f9dc55f

Code Sign

63:de:e7:d2:c4:07:e6:65:b5:95:d3:06:d6:56:3e:f8Certificate

Extended Key Usages

19:d4:98:19:33:24:88:48:ef:2f:ed:ae:86:d6:d6:16:68:d0:0d:beSigner

Headers

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

advapi32

Sections

.text Size: 193KB - Virtual size: 192KB

.data Size: 512B - Virtual size: 48B

.text4 Size: 1024B - Virtual size: 1000B

.text3 Size: 3KB - Virtual size: 2KB

.rsrc Size: 7KB - Virtual size: 6KB

.reloc Size: 2KB - Virtual size: 1KB

63:de:e7:d2:c4:07:e6:65:b5:95:d3:06:d6:56:3e:f8
Certificate

19:d4:98:19:33:24:88:48:ef:2f:ed:ae:86:d6:d6:16:68:d0:0d:be
Signer

.text
Size: 193KB - Virtual size: 192KB

.data
Size: 512B - Virtual size: 48B

.text4
Size: 1024B - Virtual size: 1000B

.text3
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 7KB - Virtual size: 6KB

.reloc
Size: 2KB - Virtual size: 1KB