b4c945b32743f0120ecfb67ccc187b5a_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

b4c945b32743f0120ecfb67ccc187b5a_JaffaCakes118
Size

1.8MB
MD5

b4c945b32743f0120ecfb67ccc187b5a
SHA1

7a36e660db57872b609d271967f895f3d8a4afae
SHA256

628064eeabd414df1949583ae56517f43eacab9fe8ecf311766137b85ffc4616
SHA512

eca8518ee1955a082260cdebd679e92e83495106fc16c1094573abeb5fa46113713a7e3450fe783f96517e2568f044eb729dd011a4f9d27292ce0901b30b898b
SSDEEP

6144:6QLMx5PAJFd7GxkMPB3K5qEudKaP4rbQm1wsrLc+iy61qP7/gRXygRm7DGfSZd:TJFd7G1pa5qErh3QTs/Piy1j/+VmgCd

Score

1^/10

Malware Config

Signatures

Files

b4c945b32743f0120ecfb67ccc187b5a_JaffaCakes118
.exe windows:4 windows x86 arch:x86

bf711bc659761e45ac6b2944ca43ac7e

Code Sign

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

13/04/2019, 10:00

Subject

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

11:21:67:1b:9c:9c:88:b9:69:99:d2:12:24:77:66:a5:d4:04
Certificate

Issuer

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

03/12/2013, 17:49

Not After

01/03/2017, 12:33

Subject

CN=Biz Secure Labs Pvt. Ltd.,O=Biz Secure Labs Pvt. Ltd.,L=Pune,ST=Maharashfra,C=IN,1.2.840.113549.1.9.1=#0c1a737570706f727440696e646961616e746976697275732e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

35:1f:9b:f8:8f:8a:ca:ad:52:6b:d4:04:f9:5f:0b:f8:a4:43:28:83
Signer

Actual PE Digest

35:1f:9b:f8:8f:8a:ca:ad:52:6b:d4:04:f9:5f:0b:f8:a4:43:28:83

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

wininet

HttpOpenRequestA
InternetCloseHandle
InternetConnectA
InternetOpenA
HttpAddRequestHeadersA
InternetGetLastResponseInfoA
InternetSetOptionA
FtpPutFileA
FtpSetCurrentDirectoryA
InternetSetStatusCallback
InternetSetOptionExA
HttpSendRequestA
InternetSetFilePointer
FtpGetFileA
InternetReadFile

shlwapi

SHGetValueA
PathIsDirectoryA
PathFileExistsA
StrStrIA

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

kernel32

TlsGetValue
GetProcessVersion
GetCPInfo
GetOEMCP
GetFileAttributesA
GetFileSize
GetFileTime
SetErrorMode
GetTickCount
RtlUnwind
CreateThread
ExitThread
ExitProcess
TerminateProcess
GetStartupInfoA
GetCommandLineA
RaiseException
HeapAlloc
HeapFree
SetStdHandle
GetFileType
GetTimeZoneInformation
GetACP
HeapReAlloc
HeapSize
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
HeapDestroy
HeapCreate
LocalReAlloc
SetUnhandledExceptionFilter
VirtualAlloc
IsBadWritePtr
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
IsBadReadPtr
IsBadCodePtr
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetProfileStringA
GetProcAddress
GetModuleHandleA
CreateEventA
CloseHandle
GlobalFree
MulDiv
GlobalUnlock
GlobalLock
ResumeThread
GlobalAlloc
LockResource
SizeofResource
LoadResource
TlsSetValue
GlobalReAlloc
TlsFree
GlobalHandle
TlsAlloc
GlobalFlags
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
FormatMessageA
LocalFree
LocalAlloc
EnterCriticalSection
FileTimeToLocalFileTime
FileTimeToSystemTime
lstrcmpA
GetCurrentThread
SuspendThread
SetThreadPriority
GetThreadLocale
GetFullPathNameA
GetVolumeInformationA
FindFirstFileA
FindClose
MoveFileA
SetEndOfFile
UnlockFile
FindResourceA
WaitForSingleObject
ResetEvent
SetEvent
WritePrivateProfileStringA
GetPrivateProfileIntA
GetPrivateProfileStringA
DeleteFileA
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
CreateFileA
DuplicateHandle
lstrcpynA
MultiByteToWideChar
WideCharToMultiByte
lstrlenA
InterlockedIncrement
SetLastError
InterlockedDecrement
GetVersion
lstrcatA
GetCurrentThreadId
GlobalGetAtomNameA
lstrcmpiA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
WinExec
lstrcpyA
GetModuleFileNameA
GetCurrentProcess
GetSystemInfo
GetWindowsDirectoryA
CopyFileA
Sleep
MoveFileExA
LoadLibraryA
FreeLibrary
GetSystemTime
CreateDirectoryA
WritePrivateProfileStructA
GetPrivateProfileStructA
GetLocalTime
GetVersionExA
CreateMutexA
ReleaseMutex
TerminateThread
GetExitCodeThread
GetSystemDirectoryA
GetLastError
CreateProcessA
VirtualFree

user32

CharNextA
CopyAcceleratorTableA
GetNextDlgGroupItem
MessageBeep
RegisterClipboardFormatA
PostThreadMessageA
PostQuitMessage
GetMessageA
TranslateMessage
ValidateRect
CharUpperA
LoadStringA
GetCursorPos
WindowFromPoint
GrayStringA
DrawTextA
TabbedTextOutA
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
GetMenuCheckMarkDimensions
LoadBitmapA
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
MoveWindow
SetWindowTextA
IsDialogMessageA
UpdateWindow
SendDlgItemMessageA
MapWindowPoints
PeekMessageA
DispatchMessageA
GetFocus
SetFocus
AdjustWindowRectEx
ScreenToClient
IsWindowVisible
GetTopWindow
MessageBoxA
IsChild
GetCapture
wsprintfA
GetClassInfoA
RegisterClassA
GetMenu
GetMenuItemCount
GetSubMenu
GetMenuItemID
GetWindowTextLengthA
GetWindowTextA
GetDlgCtrlID
GetKeyState
DefWindowProcA
CreateWindowExA
SetWindowsHookExA
CallNextHookEx
GetClassLongA
SetPropA
UnhookWindowsHookEx
GetPropA
CallWindowProcA
RemovePropA
GetMessageTime
GetMessagePos
GetLastActivePopup
GetForegroundWindow
GetWindow
SetWindowPos
RegisterWindowMessageA
OffsetRect
IntersectRect
SystemParametersInfoA
GetWindowPlacement
GetWindowRect
GetNextDlgTabItem
EndDialog
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamA
DestroyWindow
GetParent
GetDlgItem
IsWindowEnabled
IsIconic
GetSystemMetrics
DrawIcon
InflateRect
GetSysColorBrush
PtInRect
GetClassNameA
GetSystemMenu
AppendMenuA
LoadIconA
FindWindowA
ShowWindow
SetForegroundWindow
LoadCursorA
SetCursor
KillTimer
SetTimer
CopyRect
GetSysColor
FillRect
GetDC
ReleaseDC
SetRect
SendMessageA
EnableWindow
GetClientRect
IsWindow
InvalidateRect
LoadImageA
PostMessageA
GetWindowLongA
SetWindowLongA
RedrawWindow
GetDesktopWindow
DestroyMenu
MapDialogRect
SetWindowContextHelpId
IsWindowUnicode
DefDlgProcA
DrawFocusRect
ExcludeUpdateRgn
ShowCaret
HideCaret
UnregisterClassA
WinHelpA

gdi32

SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
IntersectClipRect
OffsetViewportOrgEx
GetViewportExtEx
GetWindowExtEx
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
PatBlt
GetMapMode
DPtoLP
GetTextColor
GetBkColor
LPtoDP
SetViewportOrgEx
SetMapMode
SetBkMode
GetStockObject
RestoreDC
SaveDC
CreateBitmap
SetBkColor
SetTextColor
GetClipBox
CreateFontIndirectA
CreateSolidBrush
CreateCompatibleBitmap
DeleteDC
GetDeviceCaps
CreateCompatibleDC
SelectObject
BitBlt
StretchBlt
GetObjectA
GetTextExtentPointA
CreateDIBitmap
DeleteObject

comdlg32

GetFileTitleA

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

advapi32

InitializeSecurityDescriptor
RegCloseKey
RegEnumKeyExA
RegQueryValueExA
RegQueryInfoKeyA
RegOpenKeyA
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
SetSecurityDescriptorDacl

shell32

SHGetSpecialFolderPathA
ShellExecuteExA

comctl32

_TrackMouseEvent
ImageList_ReplaceIcon
ord17
ImageList_Destroy
ImageList_Create

oledlg

ord8

ole32

CoRegisterMessageFilter
CreateStreamOnHGlobal
CLSIDFromProgID
CLSIDFromString
CoGetClassObject
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
CoTaskMemFree
CoTaskMemAlloc
OleInitialize
OleUninitialize
CoFreeUnusedLibraries
OleIsCurrentClipboard
OleFlushClipboard
CoRevokeClassObject

olepro32

ord253
ord251

oleaut32

SysAllocStringByteLen
SysStringLen
SysAllocString
VariantChangeType
VariantCopy
VariantTimeToSystemTime
VariantClear
SysAllocStringLen
SysFreeString

Sections

.text
Size: 188KB - Virtual size: 187KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bf711bc659761e45ac6b2944ca43ac7e

Code Sign

04:00:00:00:00:01:2f:4e:e1:35:5cCertificate

Extended Key Usages

Key Usages

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0bCertificate

Extended Key Usages

Key Usages

11:21:67:1b:9c:9c:88:b9:69:99:d2:12:24:77:66:a5:d4:04Certificate

Extended Key Usages

Key Usages

35:1f:9b:f8:8f:8a:ca:ad:52:6b:d4:04:f9:5f:0b:f8:a4:43:28:83Signer

Headers

File Characteristics

Imports

wininet

shlwapi

version

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

oledlg

ole32

olepro32

oleaut32

Sections

.text Size: 188KB - Virtual size: 187KB

.rdata Size: 48KB - Virtual size: 44KB

.data Size: 16KB - Virtual size: 30KB

.rsrc Size: 1.6MB - Virtual size: 1.6MB

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

11:21:67:1b:9c:9c:88:b9:69:99:d2:12:24:77:66:a5:d4:04
Certificate

35:1f:9b:f8:8f:8a:ca:ad:52:6b:d4:04:f9:5f:0b:f8:a4:43:28:83
Signer

.text
Size: 188KB - Virtual size: 187KB

.rdata
Size: 48KB - Virtual size: 44KB

.data
Size: 16KB - Virtual size: 30KB

.rsrc
Size: 1.6MB - Virtual size: 1.6MB