b81cc3bf0559c72a95b185f3e39aac50_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

b81cc3bf0559c72a95b185f3e39aac50_JaffaCakes118
Size

301KB
MD5

b81cc3bf0559c72a95b185f3e39aac50
SHA1

63cc6c8df5323478f074c600eca3a9916fba96f9
SHA256

20d19e8033724d529f3025e20fa65d02cd248a689e0849cfbc592a79e94a3535
SHA512

9e2bc2d027df8647c061dbf32183c6e3b2bdf3a800757e6932ca27525bc2c7ec1e9d38cf09bd800b8bf33737f998c2518aa2bea30a81171a4ffc4c1d49b2ae3b
SSDEEP

6144:2oMAmEYvWPxYu1XjliBI++vaZHbp2cextzBLzRj/q:xlmzvW5p+gyihBLtjC

Score

1^/10

Malware Config

Signatures

Files

b81cc3bf0559c72a95b185f3e39aac50_JaffaCakes118
.exe windows:5 windows x86 arch:x86

f3ab1f3e8b4d106760053c6bcc5d9c74

Code Sign

5c:b5:e1:c7:3f:f1:e8:5c:b7:46:6c:4d:8e:e1:df:d1
Certificate

Issuer

CN=aw1uB GlwKifhmotJAFktrjvzabfeLIkej9Mfdm8etJ1DMpHgJmxBF8AgJaLqswnMbLp13K6bpF6JB 9akqLCx5l798bfEf8ewb1j6vDzprvDbsxH8LmMDx Ii77zmhAFrygKGjeJ3n7rpcgqbx74y5qCDaco9DLFftqqGzCB EHhfvEbt2qxisuvxfhEimjG9gh1q7s M7wuMgcDzpjh1I7e9F7kBz1F3yttLD85fDxby6185nIDoqMiwwgi22sGC 6wxKCxq H3orqExsLmk66no3Eb8ltgFwmG7edvxmqkM4AzuK5MbCgfnoDGpo1dE sunehDG8nEn4rnn9Hi41l2LbLq5vbkpKK5i Lcr7MJGxc8tD34 6b818JCGltnxa63j8ABqmy8ylM18Dq pBF641fkmhveKgLemzLBAL3IJF4C47y8mtqEsn9of4k LMj4lAuKa7FeLh3zdAlkwau 3L7pAGfpk7rkfBfuh77swHLM4DxBJKnawfDmyiAkL4p8GHvu66j2m9b4lbLv6xtzD66 B4cHb97txoLq3 qenjpJyakJ6AzjIFxbJjlM lCxcg5BytFdtD89x w8LF8k5uwdwFApGIG44u3s14jn5ImBE2D AkFqzvxDttEGDGhndndq77fJCui7peBbp 1K6ewy4j57vzjjKyFdop8q6Gf8lJicreHHAHKddyL79ru1BlIu6M8H24KeHALK2w8hibydsHpFJ7hxjC36moz71Eh6pAEKzoDk61qfKnlAFyuoCBsyd6lDxes4JGeoCpqgpjpEhEvt3CGjMaIovj1vkkxB3HAn zzvC4LGnLFr7fEzi9bFhKCAvntxzpvk7kAmLexJwxyAbJn35l7zr6MJD7n5qyxuFL1jmC Dq4ibvE zqKk5CDlEbs3hzEnt43uv6hcoGzEu5CqJMiqK93KJohorndjrnB58qK6D5AtsmeFGxAF9xoqx9kkGsz48tda3qJqgxMfvIr9kqnl8L3A nrJodLk77rhJzMa2dA3GDtCvxzeF 2DhokknqC8cHIBgHyapK1knsuoFnm218hCdoGDn14DCkzlCD 8tDsea5qra ycmeK7CyHkf3KgwnyDy87uFJ2uBB9x3bHaMivoKpuoqavfGGAc66l2HBaDM gfz21myGdwwmdtoc7ieJ7csuyqeJflIMo4dFhbtBsExbcjg1p212jj8uwImiEf2CDhB3ILLcKbzvdD adyFbDrm8jozw6n JtKs31er8p1ozrBD75eaAxB5LCxmE2JaLCbcGqHwgfCFv LDpAqjoCdd4toh1f AbBqe2eiL7McyyuCawjhKtAq87hzgMs8eLeCiLfkqf53EhqJvkDrbKMbpDnDw9KlMk5fl3o9EL y cD2Ivt71L5b3sLB6tLmfKiawaM9vvbDpLAka1F D7p4JryGwKfLMI8drah9MpoxdF2Fg7cdxtmu1vhzas2dF3bB91k3dfqq8BmFv3Lhw7h4sJlL5Ec3Bbjy27j5dKMhhaoLF91qJhm5lBfxL6Fb1bg4l63zf5f2CL9sfgCFt7rs63hfLp9lEMGmrGuug45ggkc794 G4jBkI7BIDxM1aMv4EIoCGLtpbvuDJxtw2FqDhKuDLK13lAJ6Dxq3Cyv132vlFGJ56Kvonb13l7 yx5wpCuiej4 bl4k9owuktKMjIg8b5AxCx8gwyCLdftna7 xwJ4bbAutwzjqAywlrB4hDKAv6u2h1DpuefqJBEg7urBfovlLy5A9bw6Dr9yu7KFC6eqrbeanEtc3gq6kLgfa75LFitojm4MEyCI1qngnEvJt5tuMHhsqinrGu645g42t1MeCds kLdJjabwGCqEMI378HvCIaMzDLkys38hjl7m8xMDK4fwojLD7 zHl1jaIvCw7eBLELp 3gn8G88I4hgI9zu1EkFogbCIa xHoMKF6IkvDDbvoIenkmueMzHEthfwF1KAnwnC7 r3weJaCvfpho51MA1ki8tt2v31MLCpvs2DbhJl25A4awJykjoivJg67qewiz KF3MJoIrrcpEJDJKmLLJ69zxD6JwEgygCAIbK1CqnDjwhdpgD7iy8d2xeaIIf8AE4dJua42A3sGcqI599BBsye1ItqGMKhvvF agsDtnyoHo9Io5m85iyHqqpkl1gtkq4 yu1cJrHk7f5kg9qJzCjgmeamv74Hf85b7EfAgmoAzC5zsy3bhtmLbprg 9xy1up 4jFGuMJ3AEsa7qizex2gAJIzqsaArp Fs57F5q4svb vbqbMGCfHK4Dgq353EF4zJz7 LHGI9x7cJt8cGrcLzDI9B2G42onFg1dadaGJv2q6kkpruy98FD8byEyD6CDMB5mELFuk3Hd2hmE3 CzI56oJthsF1fGhxbD fpM4Fup7tA vJfhLag1kh52DfKC2GmuGqg9KKr8qc h7c6sD2FHCu3lr6 4xtfJJHCshwjKz3MJabCgDliv1A8C9E3Kiw7sdw1vgG9d6Gh3p9nzLtoLt1D81 2fLsnKbevMD4Jf8j2ksEeCADfIqjh4gGsfkp3KempCjJkpjos6ed2pk7trrKksmg4znuyGbFClndieklzopLj Hy4bxKAMlE2648mrihmugh9Mo2 paaG8HrcpBpB2I8qt4bpkrFHbDkMA3ixug38fC4CpoL4s6EEuBpvtLb5yvhyj9tdd6JdaCc78kEHIrB8H3l8aJllEgDKtELzp4n841IpE78wAyvsC4wsp9pk9dKsy6b9Ib8zjmBg Fky7ajh4tzfBl6GywkdGuelkajEo87qfK aw1uB

Not Before

15/01/2013, 17:35

Not After

31/12/2039, 23:59

Subject

CN=aw1uB GlwKifhmotJAFktrjvzabfeLIkej9Mfdm8etJ1DMpHgJmxBF8AgJaLqswnMbLp13K6bpF6JB 9akqLCx5l798bfEf8ewb1j6vDzprvDbsxH8LmMDx Ii77zmhAFrygKGjeJ3n7rpcgqbx74y5qCDaco9DLFftqqGzCB EHhfvEbt2qxisuvxfhEimjG9gh1q7s M7wuMgcDzpjh1I7e9F7kBz1F3yttLD85fDxby6185nIDoqMiwwgi22sGC 6wxKCxq H3orqExsLmk66no3Eb8ltgFwmG7edvxmqkM4AzuK5MbCgfnoDGpo1dE sunehDG8nEn4rnn9Hi41l2LbLq5vbkpKK5i Lcr7MJGxc8tD34 6b818JCGltnxa63j8ABqmy8ylM18Dq pBF641fkmhveKgLemzLBAL3IJF4C47y8mtqEsn9of4k LMj4lAuKa7FeLh3zdAlkwau 3L7pAGfpk7rkfBfuh77swHLM4DxBJKnawfDmyiAkL4p8GHvu66j2m9b4lbLv6xtzD66 B4cHb97txoLq3 qenjpJyakJ6AzjIFxbJjlM lCxcg5BytFdtD89x w8LF8k5uwdwFApGIG44u3s14jn5ImBE2D AkFqzvxDttEGDGhndndq77fJCui7peBbp 1K6ewy4j57vzjjKyFdop8q6Gf8lJicreHHAHKddyL79ru1BlIu6M8H24KeHALK2w8hibydsHpFJ7hxjC36moz71Eh6pAEKzoDk61qfKnlAFyuoCBsyd6lDxes4JGeoCpqgpjpEhEvt3CGjMaIovj1vkkxB3HAn zzvC4LGnLFr7fEzi9bFhKCAvntxzpvk7kAmLexJwxyAbJn35l7zr6MJD7n5qyxuFL1jmC Dq4ibvE zqKk5CDlEbs3hzEnt43uv6hcoGzEu5CqJMiqK93KJohorndjrnB58qK6D5AtsmeFGxAF9xoqx9kkGsz48tda3qJqgxMfvIr9kqnl8L3A nrJodLk77rhJzMa2dA3GDtCvxzeF 2DhokknqC8cHIBgHyapK1knsuoFnm218hCdoGDn14DCkzlCD 8tDsea5qra ycmeK7CyHkf3KgwnyDy87uFJ2uBB9x3bHaMivoKpuoqavfGGAc66l2HBaDM gfz21myGdwwmdtoc7ieJ7csuyqeJflIMo4dFhbtBsExbcjg1p212jj8uwImiEf2CDhB3ILLcKbzvdD adyFbDrm8jozw6n JtKs31er8p1ozrBD75eaAxB5LCxmE2JaLCbcGqHwgfCFv LDpAqjoCdd4toh1f AbBqe2eiL7McyyuCawjhKtAq87hzgMs8eLeCiLfkqf53EhqJvkDrbKMbpDnDw9KlMk5fl3o9EL y cD2Ivt71L5b3sLB6tLmfKiawaM9vvbDpLAka1F D7p4JryGwKfLMI8drah9MpoxdF2Fg7cdxtmu1vhzas2dF3bB91k3dfqq8BmFv3Lhw7h4sJlL5Ec3Bbjy27j5dKMhhaoLF91qJhm5lBfxL6Fb1bg4l63zf5f2CL9sfgCFt7rs63hfLp9lEMGmrGuug45ggkc794 G4jBkI7BIDxM1aMv4EIoCGLtpbvuDJxtw2FqDhKuDLK13lAJ6Dxq3Cyv132vlFGJ56Kvonb13l7 yx5wpCuiej4 bl4k9owuktKMjIg8b5AxCx8gwyCLdftna7 xwJ4bbAutwzjqAywlrB4hDKAv6u2h1DpuefqJBEg7urBfovlLy5A9bw6Dr9yu7KFC6eqrbeanEtc3gq6kLgfa75LFitojm4MEyCI1qngnEvJt5tuMHhsqinrGu645g42t1MeCds kLdJjabwGCqEMI378HvCIaMzDLkys38hjl7m8xMDK4fwojLD7 zHl1jaIvCw7eBLELp 3gn8G88I4hgI9zu1EkFogbCIa xHoMKF6IkvDDbvoIenkmueMzHEthfwF1KAnwnC7 r3weJaCvfpho51MA1ki8tt2v31MLCpvs2DbhJl25A4awJykjoivJg67qewiz KF3MJoIrrcpEJDJKmLLJ69zxD6JwEgygCAIbK1CqnDjwhdpgD7iy8d2xeaIIf8AE4dJua42A3sGcqI599BBsye1ItqGMKhvvF agsDtnyoHo9Io5m85iyHqqpkl1gtkq4 yu1cJrHk7f5kg9qJzCjgmeamv74Hf85b7EfAgmoAzC5zsy3bhtmLbprg 9xy1up 4jFGuMJ3AEsa7qizex2gAJIzqsaArp Fs57F5q4svb vbqbMGCfHK4Dgq353EF4zJz7 LHGI9x7cJt8cGrcLzDI9B2G42onFg1dadaGJv2q6kkpruy98FD8byEyD6CDMB5mELFuk3Hd2hmE3 CzI56oJthsF1fGhxbD fpM4Fup7tA vJfhLag1kh52DfKC2GmuGqg9KKr8qc h7c6sD2FHCu3lr6 4xtfJJHCshwjKz3MJabCgDliv1A8C9E3Kiw7sdw1vgG9d6Gh3p9nzLtoLt1D81 2fLsnKbevMD4Jf8j2ksEeCADfIqjh4gGsfkp3KempCjJkpjos6ed2pk7trrKksmg4znuyGbFClndieklzopLj Hy4bxKAMlE2648mrihmugh9Mo2 paaG8HrcpBpB2I8qt4bpkrFHbDkMA3ixug38fC4CpoL4s6EEuBpvtLb5yvhyj9tdd6JdaCc78kEHIrB8H3l8aJllEgDKtELzp4n841IpE78wAyvsC4wsp9pk9dKsy6b9Ib8zjmBg Fky7ajh4tzfBl6GywkdGuelkajEo87qfK aw1uB

Extended Key Usages

ExtKeyUsageCodeSigning

82:f2:84:c8:aa:e1:77:e5:2c:e0:d4:94:bd:8c:73:07:1b:30:11:d2
Signer

Actual PE Digest

82:f2:84:c8:aa:e1:77:e5:2c:e0:d4:94:bd:8c:73:07:1b:30:11:d2

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualAlloc
ExitProcess

user32

LoadIconA
LoadCursorA
ShowWindow

gdi32

GetStockObject

advapi32

OpenProcessToken
WriteEncryptedFileRaw
StartServiceW
SetSecurityDescriptorDacl
SetFileSecurityW
SetEntriesInAclW
ReportEventW
RegisterEventSourceW
RegUnLoadKeyW
AddAccessAllowedAce
AdjustTokenPrivileges
AllocateAndInitializeSid
CheckTokenMembership
CloseEncryptedFileRaw
CloseServiceHandle
ControlService
DecryptFileW
DeleteAce
EncryptFileW
EnumDependentServicesW
EqualSid
FreeSid
GetAce
GetSecurityDescriptorDacl
GetTokenInformation
GetUserNameW
InitializeAcl
InitializeSecurityDescriptor
LookupAccountSidW
LookupPrivilegeValueW
OpenEncryptedFileRawW
OpenSCManagerW
OpenServiceW
OpenThreadToken
QueryServiceStatus
ReadEncryptedFileRaw
RegCloseKey
RegConnectRegistryW
RegCreateKeyExW
RegDeleteValueW
RegEnumKeyExW
RegEnumValueW
RegFlushKey
RegLoadKeyW
RegOpenKeyExA
RegOpenKeyExW
RegOpenKeyW
RegQueryValueExA
RegQueryValueExW
RegReplaceKeyW
RegRestoreKeyW
RegSaveKeyW
RegSetValueExW

msvcrt

_CxxThrowException
_XcptFilter
__CxxFrameHandler
__dllonexit
__p__commode
__p__fmode
__set_app_type
__setusermatherr
__wgetmainargs
_adjust_fdiv
_c_exit
_cexit
_controlfp
_errno
_except_handler3
_exit
_fdopen
_filelength
_ftol
_getpid
_initterm
_local_unwind2
_mbscpy
_mbslen
_onexit
_open_osfhandle
_purecall
_putenv
_snwprintf
_tzset
_vsnwprintf
_wcmdln
_wcsdup
_wcsicmp
_wcslwr
_wcsnicmp
_wcsrev
_wcsupr
_wfopen
_wtoi
calloc
clearerr
exit
fclose
fflush
fread
free
fseek
ftell
fwrite
isalpha
isspace
localtime
malloc
memmove
mktime
realloc
swprintf
swscanf
time
wcscat
wcschr
wcscmp
wcscpy
wcslen
wcsncat
wcsncmp
wcsncpy
wcspbrk
wcsrchr
wcsstr
wcstok
wprintf

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 264KB - Virtual size: 263KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

ata3
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

ata2
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

ata
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f3ab1f3e8b4d106760053c6bcc5d9c74

Code Sign

5c:b5:e1:c7:3f:f1:e8:5c:b7:46:6c:4d:8e:e1:df:d1Certificate

Extended Key Usages

82:f2:84:c8:aa:e1:77:e5:2c:e0:d4:94:bd:8c:73:07:1b:30:11:d2Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

msvcrt

Sections

.text Size: 3KB - Virtual size: 2KB

.rdata Size: 264KB - Virtual size: 263KB

.data Size: 10KB - Virtual size: 10KB

ata3 Size: 512B - Virtual size: 100B

ata2 Size: 512B - Virtual size: 100B

ata Size: 512B - Virtual size: 100B

.rsrc Size: 3KB - Virtual size: 2KB

.reloc Size: 1KB - Virtual size: 1KB

5c:b5:e1:c7:3f:f1:e8:5c:b7:46:6c:4d:8e:e1:df:d1
Certificate

82:f2:84:c8:aa:e1:77:e5:2c:e0:d4:94:bd:8c:73:07:1b:30:11:d2
Signer

.text
Size: 3KB - Virtual size: 2KB

.rdata
Size: 264KB - Virtual size: 263KB

.data
Size: 10KB - Virtual size: 10KB

ata3
Size: 512B - Virtual size: 100B

ata2
Size: 512B - Virtual size: 100B

ata
Size: 512B - Virtual size: 100B

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 1KB - Virtual size: 1KB