be2618df33883f16eb2ce03597388228_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

be2618df33883f16eb2ce03597388228_JaffaCakes118
Size

350KB
MD5

be2618df33883f16eb2ce03597388228
SHA1

02b164466caaedba130977895e33379e5c631552
SHA256

f6d9a605a33e87537d6873ac2f4019cd735d8e95ead479ab56e7c26cb213cd81
SHA512

a4f570e4853ce1a4766b7270059330375a096a11e73f9a2fb63948769f26c8599aaf83004d5f0ac4c6d0a302e2037f7f183a49b0a138478bbeb660b0e96fd08c
SSDEEP

6144:LRwQ298qHyHWrCggl1PhmAl5hxQ9xjYqMk6:9v296BXldll5hCUq6

Score

1^/10

Malware Config

Signatures

Files

be2618df33883f16eb2ce03597388228_JaffaCakes118
.exe windows:5 windows x86 arch:x86

32a75bde86b5fa767be8fec7dbcfdb7c

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2a:41:fa:c6:2a:d4:fa:69:9e:71:ab:33:8e:a1:df:ec
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

03/05/2011, 00:00

Not After

02/05/2013, 23:59

Subject

CN=SpectorSoft Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Spector CNE,O=SpectorSoft Corporation,L=Vero Beach,ST=Florida,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

d7:69:da:6a:8f:e6:4a:a5:c5:e9:ae:4a:80:1f:f1:2a:20:16:3c:59
Signer

Actual PE Digest

d7:69:da:6a:8f:e6:4a:a5:c5:e9:ae:4a:80:1f:f1:2a:20:16:3c:59

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

mxcrsc32.pdb

Imports

kernel32

FindFirstFileA
FindNextFileA
FindClose
RemoveDirectoryA
CreateDirectoryA
GetCurrentDirectoryA
SetCurrentDirectoryA
GetCurrentProcess
SetFileAttributesA
GetTickCount
GetComputerNameW
CompareStringW
CreateFileW
WriteConsoleW
SetStdHandle
DeleteCriticalSection
GetComputerNameA
LoadLibraryW
HeapReAlloc
RtlUnwind
GetConsoleMode
GetConsoleCP
QueryPerformanceCounter
GetFileType
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameW
GetStdHandle
ExitProcess
HeapSize
GetStringTypeW
IsProcessorFeaturePresent
LCMapStringW
SetLastError
GetModuleHandleW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
GetCPInfo
RaiseException
GetStartupInfoW
HeapSetInformation
SetEnvironmentVariableA
GetCommandLineA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetDateFormatA
GetTimeFormatA
GetSystemTimeAsFileTime
DecodePointer
EncodePointer
InitializeCriticalSection
HeapCreate
HeapFree
HeapAlloc
MultiByteToWideChar
DeviceIoControl
GetVersionExA
GetACP
GetDriveTypeA
FlushFileBuffers
SetEndOfFile
Sleep
CreateFileA
TerminateProcess
GetVersion
GetTimeZoneInformation
GetCurrentProcessId
MoveFileA
DeleteFileA
SetFileTime
GetFileTime
GetSystemDirectoryA
WriteFile
ReadFile
SetFilePointer
GetFileSize
CloseHandle
WaitForSingleObject
CreateSemaphoreA
FreeLibrary
GetLastError
GetProcAddress
LeaveCriticalSection
LoadLibraryA
EnterCriticalSection
HeapDestroy
WideCharToMultiByte
lstrlenA
InterlockedDecrement
InterlockedIncrement
OutputDebugStringA
GetCurrentThreadId
GetModuleHandleA
GetModuleFileNameA

user32

LoadStringA
LoadIconA
LoadCursorA
wsprintfA
MapVirtualKeyExA
MapVirtualKeyA
GetKeyboardLayout
EnumDisplaySettingsA
wsprintfW
GetKeyNameTextA
GetForegroundWindow
DefWindowProcA
PostQuitMessage
DestroyWindow
DispatchMessageA
TranslateMessage
PeekMessageA
MsgWaitForMultipleObjects
CreateWindowExA
RegisterClassA

gdi32

GetStockObject

advapi32

RegDeleteValueA
RegEnumValueA
RegEnumKeyExA
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
RegSetValueExA
RegCreateKeyExA
GetUserNameA
RegDeleteKeyA

shell32

SHGetPathFromIDListA
SHGetMalloc
SHGetSpecialFolderLocation

ole32

CoUninitialize
CoCreateInstance
CoInitialize

oleaut32

VariantClear
VariantInit
SysFreeString
SysAllocString
SysAllocStringLen

Sections

.text
Size: 179KB - Virtual size: 179KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 139KB - Virtual size: 138KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 852B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

32a75bde86b5fa767be8fec7dbcfdb7c

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

2a:41:fa:c6:2a:d4:fa:69:9e:71:ab:33:8e:a1:df:ecCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

d7:69:da:6a:8f:e6:4a:a5:c5:e9:ae:4a:80:1f:f1:2a:20:16:3c:59Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

Sections

.text Size: 179KB - Virtual size: 179KB

.rdata Size: 139KB - Virtual size: 138KB

.data Size: 6KB - Virtual size: 15KB

.rsrc Size: 1024B - Virtual size: 852B

.reloc Size: 17KB - Virtual size: 17KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

2a:41:fa:c6:2a:d4:fa:69:9e:71:ab:33:8e:a1:df:ec
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

d7:69:da:6a:8f:e6:4a:a5:c5:e9:ae:4a:80:1f:f1:2a:20:16:3c:59
Signer

.text
Size: 179KB - Virtual size: 179KB

.rdata
Size: 139KB - Virtual size: 138KB

.data
Size: 6KB - Virtual size: 15KB

.rsrc
Size: 1024B - Virtual size: 852B

.reloc
Size: 17KB - Virtual size: 17KB