b71f225bccb6c2279a41e22ad5bfb9f7_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

b71f225bccb6c2279a41e22ad5bfb9f7_JaffaCakes118
Size

241KB
MD5

b71f225bccb6c2279a41e22ad5bfb9f7
SHA1

d747aec6e7d8e0362095fad9767d89dfcfecacfe
SHA256

2aabeb83cc5c041ed49a63032957e5a49189fe162945198ab3023cd066d589b6
SHA512

92500d1423ca0d2be94c22b44c0a50f47d90c92b02f31ac342e2a8f2b632cff048ecbf1ac04e0f6c946c0e1e1b30fad28a7cf1d2f888b6853891e1a88de87fc0
SSDEEP

6144:oO4o2lSOMDP2mvRPdCVS0TxidVGSbEMcN6eZ3/FIEONVdWa:oL3S2mv6NqDta6eZ3/mEOJWa

Score

1^/10

Malware Config

Signatures

Files

b71f225bccb6c2279a41e22ad5bfb9f7_JaffaCakes118
.exe windows:5 windows x86 arch:x86

5ac950e1b4992993d71092ff650490db

Code Sign

7c:b4:5a:b3:70:a1:82:07:78:b4:e7:1e:8a:32:76:1b
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

10/05/2010, 00:00

Not After

09/05/2012, 23:59

Subject

CN=Towers Watson & Co,OU=Digital ID Class 3 - Microsoft VBA Software Validation v2,O=Towers Watson & Co,L=Philadelphia,ST=Pennsylvania,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

be:56:1e:3a:b1:65:bb:00:d5:4f:9c:76:f6:49:17:82:36:01:96:e8
Signer

Actual PE Digest

be:56:1e:3a:b1:65:bb:00:d5:4f:9c:76:f6:49:17:82:36:01:96:e8

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

L:\TmwHjcZ\ckoVrgDeluyb\zVchbtqaTiovrI\gJqFeeHmAxy.pdb

Imports

comctl32

PropertySheetW
CreateToolbarEx
ImageList_Write
ImageList_Draw
DestroyPropertySheetPage
ImageList_ReplaceIcon

kernel32

IsDBCSLeadByteEx
SetUnhandledExceptionFilter
GetAtomNameA
SetupComm
AreFileApisANSI
GetSystemDefaultUILanguage
VirtualQuery
GetFileAttributesA
GlobalFlags
SetTimerQueueTimer
AddAtomA
GetSystemDefaultLangID
GetLocaleInfoW
CreateEventA
HeapFree
GetTempPathA
GetWindowsDirectoryW
WaitForMultipleObjectsEx
FindResourceW
FindFirstChangeNotificationW
GetLongPathNameW
FindNextChangeNotification
WaitForSingleObject
SetEndOfFile
SetFileApisToOEM
TransactNamedPipe
GetTempPathW
IsValidLanguageGroup
CancelIo
GlobalFree
VirtualProtect
LocalReAlloc
SetCommMask
Sleep
HeapUnlock
SetThreadPriority
SizeofResource
VirtualAlloc
CopyFileA
SetCommTimeouts
GetVersionExA
LocalLock
CloseHandle
GetUserDefaultLCID
GetCurrentThread
LoadLibraryA
SetSystemTime
VirtualFree
GetSystemWindowsDirectoryA
OpenEventA
GlobalLock
SetCurrentDirectoryW
LoadLibraryExA
LoadResource
FindResourceA

msvcrt

iswctype
isupper
iswspace
_controlfp
setlocale
fprintf
towlower
__set_app_type
wcscoll
fclose
mktime
wcstok
wcscspn
__p__fmode
isspace
fgetc
strcspn
wcsncpy
tolower
__p__commode
islower
_amsg_exit
iswxdigit
isalnum
strrchr
_initterm
ftell
atoi
qsort
_ismbblead
strstr
isprint
_XcptFilter
time
_exit
wcstol
strchr
gmtime
remove
_cexit
__setusermatherr
ungetc
strncpy
printf
calloc
clearerr
__getmainargs

user32

CreateMenu
IsCharUpperA
GetScrollPos
OpenInputDesktop
GetUserObjectInformationW
GetClassInfoA
GetNextDlgGroupItem
MonitorFromPoint
TranslateMessage
BeginPaint
GetClassInfoExA
CharUpperBuffW
GetNextDlgTabItem
GetSubMenu
GetWindowTextLengthW
GetMenuStringW
GetSystemMetrics
WaitMessage
ShowCaret
GetUpdateRgn
IsChild
ScreenToClient
GetKeyNameTextW
FindWindowW
RegisterWindowMessageA
GetDlgItem
IsIconic
ToUnicodeEx
DrawTextExW
GetWindowLongW
IsCharAlphaW
IsZoomed
RegisterClassA
MoveWindow
UpdateWindow
AttachThreadInput
GetMessageA
TranslateAcceleratorA
SetSysColors
CharNextA
FillRect
DefWindowProcW
DrawFocusRect
CreateWindowExA
CallWindowProcW
SetRectEmpty
SetMenuItemInfoW
GetKeyboardLayout
CharUpperA
SetDlgItemTextA
ChangeMenuW
DrawStateW
EnableMenuItem
GetForegroundWindow
LoadImageW
DefFrameProcA
RegisterHotKey
GetMenuItemID
ShowOwnedPopups
LoadCursorA
GetPropW
TabbedTextOutW
SendNotifyMessageW
GetKeyboardLayoutNameW
MapVirtualKeyExW
GetFocus
DialogBoxIndirectParamW
OpenDesktopW
GetClientRect
LoadImageA
GetParent
LoadAcceleratorsA
EndDialog
DrawFrameControl
RegisterWindowMessageW
SetScrollRange
GetMessageExtraInfo
GetDoubleClickTime
GetCaretPos
SetDlgItemTextW
GetDlgItemTextW
GetMonitorInfoW
SetMenuDefaultItem
SetParent
ShowCursor
GetSysColorBrush
GetScrollRange
ActivateKeyboardLayout
InSendMessage
CharLowerA
GetClassLongA
LockWindowUpdate
MapVirtualKeyW
HideCaret
SendMessageA
InternalGetWindowText
HiliteMenuItem
ShowScrollBar
CreateDialogParamW
SendMessageTimeoutA
DrawIconEx
CreateIconFromResource
ScrollWindow
ExitWindowsEx
SetFocus
IsCharAlphaA
EqualRect
CloseDesktop
SetRect
DestroyCursor
GetDlgItemTextA
GetWindowDC
TrackPopupMenuEx
GetDCEx
DefDlgProcA
ReplyMessage
GetKeyState
EnableScrollBar
GrayStringW

gdi32

CreateBitmapIndirect
CreateEllipticRgnIndirect
CreateHatchBrush
GetViewportOrgEx
FillRgn
GetObjectW
GetBkMode
CreateCompatibleBitmap
StartPage
SetLayout
UnrealizeObject
SetPixel
GetTextExtentPointW
SetViewportOrgEx
ExtFloodFill
PtVisible
GetMapMode
CreateDIBSection
GetNearestColor
AddFontResourceW
RectVisible
ResizePalette
GetTextExtentPoint32W
WidenPath
CreateDiscardableBitmap
GetTextFaceW
SetDIBits
IntersectClipRect
GetDIBColorTable
PtInRegion
GetTextMetricsA
GetDIBits
CreateFontIndirectA
ScaleWindowExtEx
EnumFontFamiliesExW
GetTextExtentPoint32A
GetTextCharsetInfo
ScaleViewportExtEx
SetTextColor
CreateBitmap
Escape
SetAbortProc
CreatePolygonRgn
ExcludeClipRect
Rectangle
SetBrushOrgEx
GetTextAlign
CreateRoundRectRgn
CreateCompatibleDC
GetCharWidth32W
CreateHalftonePalette

Exports

Exports

?ExtractOptions@@YGK_KHE[D

Sections

.text
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 294B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.div
Size: 512B - Virtual size: 128B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2KB - Virtual size: 167KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 206KB - Virtual size: 205KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5ac950e1b4992993d71092ff650490db

Code Sign

7c:b4:5a:b3:70:a1:82:07:78:b4:e7:1e:8a:32:76:1bCertificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

be:56:1e:3a:b1:65:bb:00:d5:4f:9c:76:f6:49:17:82:36:01:96:e8Signer

Headers

File Characteristics

PDB Paths

Imports

comctl32

kernel32

msvcrt

user32

gdi32

Exports

Exports

Sections

.text Size: 20KB - Virtual size: 20KB

.idata Size: 6KB - Virtual size: 5KB

.edata Size: 512B - Virtual size: 294B

.div Size: 512B - Virtual size: 128B

.data Size: 2KB - Virtual size: 167KB

.rsrc Size: 206KB - Virtual size: 205KB

.reloc Size: 1KB - Virtual size: 1KB

7c:b4:5a:b3:70:a1:82:07:78:b4:e7:1e:8a:32:76:1b
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

be:56:1e:3a:b1:65:bb:00:d5:4f:9c:76:f6:49:17:82:36:01:96:e8
Signer

.text
Size: 20KB - Virtual size: 20KB

.idata
Size: 6KB - Virtual size: 5KB

.edata
Size: 512B - Virtual size: 294B

.div
Size: 512B - Virtual size: 128B

.data
Size: 2KB - Virtual size: 167KB

.rsrc
Size: 206KB - Virtual size: 205KB

.reloc
Size: 1KB - Virtual size: 1KB