b915191fe54d81effcda99cc9d18e32a_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

b915191fe54d81effcda99cc9d18e32a_JaffaCakes118
Size

51KB
MD5

b915191fe54d81effcda99cc9d18e32a
SHA1

e3f4f2b4ecf6fc49c96fd136afc9c4ab26768cd5
SHA256

2736dd77aaa165ef3942d39f1616e6107808625fbc96c439e862f3b42637623c
SHA512

39a5bea3d9068944d6126e782e2e190fde70a5e79b03919d5f9e54a74085cd5e554b1766edf1ff603a3c2cfe43974701b3ba7eedcb0b2477705b35d626ae1d00
SSDEEP

768:Hv2k+IdCOSrq46QNMo9DN2UuzknUY63e8P7gKgCiPE1Uf2hr:1bd4n9B2UAY63VP7gnP8Ufc

Score

1^/10

Malware Config

Signatures

Files

b915191fe54d81effcda99cc9d18e32a_JaffaCakes118
.dll windows:6 windows x86 arch:x86

61f46b04f9c39247bc92efba3c0491a5

Code Sign

0e:a0:fe:4d:fb:74:cc:64:bc:32:14:31:03:c2:7c:8b
Certificate

Issuer

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

12-07-2019 00:00

Not After

10-07-2020 12:00

Subject

CN=Trend Micro\, Inc.,OU=Taipei\, TW,O=Trend Micro\, Inc.,L=Taipei,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2014 00:00

Not After

22-10-2024 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11-02-2011 12:00

Not After

10-02-2026 12:00

Subject

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10-11-2006 00:00

Not After

10-11-2021 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

59:40:b8:27:93:45:f0:1c:05:84:33:53:8d:7e:59:0c
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

14-06-2019 00:00

Not After

03-08-2020 23:59

Subject

CN=Trend Micro\, Inc.,O=Trend Micro\, Inc.,L=Taipei,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-10-2019 00:00

Not After

17-10-2030 00:00

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-01-2016 12:00

Not After

07-01-2031 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2e:16:42:9e:e3:0d:a0:37:cf:e7:35:cd:e6:1a:bc:7e:c7:85:2b:36:df:1b:6f:12:ad:06:b7:29:ca:d2:cf:34
Signer

Actual PE Digest

2e:16:42:9e:e3:0d:a0:37:cf:e7:35:cd:e6:1a:bc:7e:c7:85:2b:36:df:1b:6f:12:ad:06:b7:29:ca:d2:cf:34

Digest Algorithm

sha256

PE Digest Matches

true

88:27:43:7f:09:94:90:df:2f:79:56:98:52:23:98:2e:95:3b:eb:17
Signer

Actual PE Digest

88:27:43:7f:09:94:90:df:2f:79:56:98:52:23:98:2e:95:3b:eb:17

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\DRE_1.8\src\Release\DCEBootConfig.pdb

Imports

kernel32

DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
CloseHandle
ExpandEnvironmentStringsW
GetCurrentProcessId
OpenProcess
LocalFree
DeleteFileW
GetPrivateProfileStringW
GetLastError
CopyFileW
GetModuleFileNameW
GetLocalTime
GetShortPathNameW
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
UnhandledExceptionFilter

advapi32

InitializeSecurityDescriptor
RegDeleteKeyW
RegEnumKeyW
RegSetValueExW
RegQueryInfoKeyW
RegQueryValueExW
SetSecurityDescriptorDacl
AddAccessAllowedAce
AddAce
GetAce
InitializeAcl
GetLengthSid
GetAclInformation
GetSecurityDescriptorDacl
RegGetKeySecurity
GetSecurityInfo
GetSecurityDescriptorOwner
GetNamedSecurityInfoW
RegOpenKeyExW
RegSetKeySecurity
RegCloseKey
SetNamedSecurityInfoW

msvcp140

?_Xlength_error@std@@YAXPBD@Z

vcruntime140

_CxxThrowException
__current_exception_context
__current_exception
memcpy
__std_exception_destroy
__std_exception_copy
__CxxFrameHandler3
_except_handler4_common
__std_type_info_destroy_list
memset
memmove

api-ms-win-crt-stdio-l1-1-0

ftell
fclose
fseek
_wfopen
__stdio_common_vswprintf_s
fread
feof
__stdio_common_vswprintf
fwrite

api-ms-win-crt-string-l1-1-0

wcsnlen
wcsncat
wcsncpy
_wcsicmp

api-ms-win-crt-convert-l1-1-0

wcstoul

api-ms-win-crt-runtime-l1-1-0

_initterm
terminate
_initterm_e
_invalid_parameter_noinfo_noreturn
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit

api-ms-win-crt-heap-l1-1-0

malloc
free
_callnewh

api-ms-win-crt-filesystem-l1-1-0

_wsplitpath

Exports

Exports

DbeAllocResults
DbeBootCopyFile
DbeBootDeleteFile
DbeBootMoveFile
DbeDeleteResults
DbeFetchResult
DbeFreeResults
DbeRegisterLogCallback
DbeSetBinaryPath

Sections

.text
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

61f46b04f9c39247bc92efba3c0491a5

Code Sign

0e:a0:fe:4d:fb:74:cc:64:bc:32:14:31:03:c2:7c:8bCertificate

Extended Key Usages

Key Usages

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66Certificate

Extended Key Usages

Key Usages

02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5fCertificate

Extended Key Usages

Key Usages

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1bCertificate

Extended Key Usages

Key Usages

59:40:b8:27:93:45:f0:1c:05:84:33:53:8d:7e:59:0cCertificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6dCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

2e:16:42:9e:e3:0d:a0:37:cf:e7:35:cd:e6:1a:bc:7e:c7:85:2b:36:df:1b:6f:12:ad:06:b7:29:ca:d2:cf:34Signer

88:27:43:7f:09:94:90:df:2f:79:56:98:52:23:98:2e:95:3b:eb:17Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

advapi32

msvcp140

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

Exports

Exports

Sections

.text Size: 22KB - Virtual size: 21KB

.rdata Size: 9KB - Virtual size: 9KB

.data Size: 1024B - Virtual size: 1KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 1KB

0e:a0:fe:4d:fb:74:cc:64:bc:32:14:31:03:c2:7c:8b
Certificate

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f
Certificate

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

59:40:b8:27:93:45:f0:1c:05:84:33:53:8d:7e:59:0c
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

2e:16:42:9e:e3:0d:a0:37:cf:e7:35:cd:e6:1a:bc:7e:c7:85:2b:36:df:1b:6f:12:ad:06:b7:29:ca:d2:cf:34
Signer

88:27:43:7f:09:94:90:df:2f:79:56:98:52:23:98:2e:95:3b:eb:17
Signer

.text
Size: 22KB - Virtual size: 21KB

.rdata
Size: 9KB - Virtual size: 9KB

.data
Size: 1024B - Virtual size: 1KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 1KB