c04d57371a10d37abee517f9b764801c_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

c04d57371a10d37abee517f9b764801c_JaffaCakes118
Size

239KB
MD5

c04d57371a10d37abee517f9b764801c
SHA1

c0ed478b5f6de0f67ef793d4a8775a11efe0aee6
SHA256

903a004ac48315a4fea7987ab54bbd8c705f5935e6b701f88bbb866530f23dcc
SHA512

92321c8157388e9d983ff89522f187488e9b3a6d715b5858c3e0fd741c505fc5f91f9e674afcf9f1d5e4c36f7bec906e552f91d82525aa5d6cb8d19524bf75e4
SSDEEP

3072:7CvDqCR2tJP8iHS+wCkAFAGHWZLf7iHyiUkveZjy4uj55Rv+EWp+2pA:7URehFRHWZLkpU1ZjKRZWp5A

Score

1^/10

Malware Config

Signatures

Files

c04d57371a10d37abee517f9b764801c_JaffaCakes118
.exe windows:5 windows x86 arch:x86

279bb8b7b5d0eaf659d4c75f32b58f0d

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

46:24:1c:de:5c:7b:50:0b:51:c5:f1:32:82:28:f2:a9
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

28/01/2011, 00:00

Not After

27/01/2013, 23:59

Subject

CN=Zugo Ltd,O=Zugo Ltd,POSTALCODE=JE4 9NU,STREET=37 Broad St.+STREET=1st Floor+STREET=PO Box 36,L=St Helier,ST=Jersey,C=JE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

84:14:f3:a5:97:f0:78:d0:65:c8:fe:13:4b:8e:28:0c:e1:15:7d:15
Signer

Actual PE Digest

84:14:f3:a5:97:f0:78:d0:65:c8:fe:13:4b:8e:28:0c:e1:15:7d:15

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\Work\zugo-toolbar\ZTB_2.4\Components\ZugoBuild\Release\ToolbarUpdaterService.pdb

Imports

psapi

EnumProcesses
GetModuleBaseNameW

kernel32

ProcessIdToSessionId
Process32NextW
HeapFree
GetProcessHeap
GetCurrentProcess
HeapAlloc
LocalFree
LocalAlloc
GetVersionExW
GetTempPathW
GetPrivateProfileStringW
GetPrivateProfileIntW
GetFileAttributesW
FindFirstFileW
FindNextFileW
DeleteFileW
FindClose
CreateFileW
RemoveDirectoryW
CreateNamedPipeW
Process32FirstW
GetCurrentDirectoryW
ReadFile
DisconnectNamedPipe
WriteFile
EnterCriticalSection
LeaveCriticalSection
SetLastError
GetTickCount
CreateThread
TerminateThread
LCMapStringA
GetConsoleMode
GetConsoleCP
WideCharToMultiByte
SetFilePointer
LoadLibraryA
InitializeCriticalSectionAndSpinCount
LCMapStringW
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoA
GetFileType
SetHandleCount
GetCommandLineW
CreateToolhelp32Snapshot
WaitForSingleObject
WTSGetActiveConsoleSessionId
OpenProcess
CloseHandle
Sleep
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
GetModuleFileNameW
LoadLibraryExW
MultiByteToWideChar
GetLastError
RaiseException
lstrcmpiW
GetModuleHandleW
GetProcAddress
lstrlenW
FreeLibrary
GetModuleHandleA
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
FlushFileBuffers
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
ConnectNamedPipe
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetCurrentThreadId
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleFileNameA
GetStdHandle
ExitProcess
HeapCreate
VirtualAlloc
VirtualFree
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
RtlUnwind
CreateDirectoryW
GetStartupInfoW
GetSystemTimeAsFileTime
HeapSize
HeapReAlloc
HeapDestroy

user32

CharNextW
wsprintfW

advapi32

DeleteService
FreeSid
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetEntriesInAclW
AllocateAndInitializeSid
GetSidSubAuthority
GetSidSubAuthorityCount
GetSidIdentifierAuthority
IsValidSid
GetTokenInformation
AdjustTokenPrivileges
SetTokenInformation
LookupPrivilegeValueW
OpenProcessToken
CreateProcessAsUserW
DuplicateTokenEx
RegQueryValueExW
ControlService
StartServiceW
OpenServiceW
CloseServiceHandle
CreateServiceW
OpenSCManagerW
SetServiceStatus
RegisterServiceCtrlHandlerW
StartServiceCtrlDispatcherW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
RegDeleteKeyW

ole32

CoCreateInstance
CoUninitialize
CoInitialize
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc

oleaut32

SysAllocString
VarUI4FromStr
SysFreeString
VariantInit
VariantClear
VariantChangeType
SysStringLen
VarBstrCat
VarBstrCmp
SysAllocStringLen
SysStringByteLen
SysAllocStringByteLen

urlmon

URLDownloadToFileW

netapi32

NetApiBufferFree
NetUserEnum

userenv

GetProfilesDirectoryW
DestroyEnvironmentBlock
CreateEnvironmentBlock

wtsapi32

WTSQueryUserToken

Sections

.text
Size: 139KB - Virtual size: 138KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

279bb8b7b5d0eaf659d4c75f32b58f0d

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:beCertificate

Extended Key Usages

Key Usages

46:24:1c:de:5c:7b:50:0b:51:c5:f1:32:82:28:f2:a9Certificate

Extended Key Usages

Key Usages

84:14:f3:a5:97:f0:78:d0:65:c8:fe:13:4b:8e:28:0c:e1:15:7d:15Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

psapi

kernel32

user32

advapi32

ole32

oleaut32

urlmon

netapi32

userenv

wtsapi32

Sections

.text Size: 139KB - Virtual size: 138KB

.rdata Size: 29KB - Virtual size: 28KB

.data Size: 5KB - Virtual size: 13KB

.rsrc Size: 48KB - Virtual size: 48KB

.reloc Size: 12KB - Virtual size: 12KB

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

46:24:1c:de:5c:7b:50:0b:51:c5:f1:32:82:28:f2:a9
Certificate

84:14:f3:a5:97:f0:78:d0:65:c8:fe:13:4b:8e:28:0c:e1:15:7d:15
Signer

.text
Size: 139KB - Virtual size: 138KB

.rdata
Size: 29KB - Virtual size: 28KB

.data
Size: 5KB - Virtual size: 13KB

.rsrc
Size: 48KB - Virtual size: 48KB

.reloc
Size: 12KB - Virtual size: 12KB