c0cb844ba1c637e7cf02208b74605a20_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

c0cb844ba1c637e7cf02208b74605a20_JaffaCakes118
Size

385KB
MD5

c0cb844ba1c637e7cf02208b74605a20
SHA1

1caf4aea484c4f29ad1c37284f443221a8fdbebc
SHA256

5c32371a84d29d3d232640c0b7665c682382db15a82da2ad367f58bc2972314a
SHA512

d82c11e39e201ad913eccf31b7f4b9202a0a1943065b1e1889a5c705a7fcc19d0743f48a26b8bf48c8d98639ef881ff6e065daae59821b2d06de1a0c559206c1
SSDEEP

6144:s+2UOy8rPU7Oo+A66YAdIzewrdcgdVMgHnrZmA+zFcfcV9WSd3ojDuUla:X2tU7V26YAdIz/MgHnrgfRFheDuUla

Score

1^/10

Malware Config

Signatures

Files

c0cb844ba1c637e7cf02208b74605a20_JaffaCakes118
.exe windows:4 windows x86 arch:x86

10be2a807a7a3deb71d83d6b8794102d

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

28:d2:02:39:8d:a9:29:fc:de:fa:15:a5:3c:d0:d7:80
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

03/08/2006, 00:00

Not After

05/09/2007, 23:59

Subject

CN=Hewlett Packard,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Desktop Consumer Solutions,O=Hewlett Packard,L=San Diego,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

lz32

LZOpenFileA
LZCopy
LZClose

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

kernel32

OpenMutexA
CreateMutexA
FindResourceExA
LoadResource
LockResource
GetUserDefaultLangID
FormatMessageA
LocalFree
GetStartupInfoA
CreateProcessA
GetExitCodeProcess
WaitForSingleObject
TerminateProcess
CreateDirectoryA
FlushFileBuffers
GlobalAlloc
GlobalFree
HeapFree
GetProcessHeap
HeapAlloc
GetFileTime
DeleteFileA
Sleep
GetDriveTypeA
GetSystemDirectoryA
GetTempPathA
SetHandleCount
GetLocaleInfoA
InitializeCriticalSection
GetFileSize
GetCommandLineA
DeleteCriticalSection
QueryPerformanceCounter
QueryPerformanceFrequency
WriteFile
OutputDebugStringA
GetEnvironmentVariableA
CompareStringW
CompareStringA
GetVersion
WideCharToMultiByte
InterlockedExchange
GetSystemDefaultLangID
GetVersionExA
SetFileAttributesA
lstrcmpA
GetFileAttributesExA
CompareFileTime
SetLastError
lstrcpyA
lstrcatA
GetTempFileNameA
MoveFileExA
WritePrivateProfileStringA
CreateFileA
GetShortPathNameA
GetWindowsDirectoryA
FindFirstFileA
FindNextFileA
FindClose
CloseHandle
GetPrivateProfileStringA
GetCurrentDirectoryA
lstrlenA
GetModuleHandleA
GetModuleFileNameA
GetProcAddress
GetCurrentProcess
FreeLibrary
LoadLibraryA
GlobalAddAtomA
GlobalDeleteAtom
GetCurrentThreadId
GetTickCount
MultiByteToWideChar
GetLastError
EnterCriticalSection
LeaveCriticalSection
GetFullPathNameA
GetFileAttributesA
GetStringTypeW
GetConsoleCP
GetConsoleMode
SetEnvironmentVariableA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GlobalLock
SizeofResource
FindResourceA
EnumResourceLanguagesA
ConvertDefaultLocale
GetCurrentThread
GlobalUnlock
LocalAlloc
GetCurrentProcessId
lstrcmpW
GlobalFindAtomA
GlobalGetAtomNameA
GlobalFlags
InterlockedDecrement
TlsGetValue
GlobalReAlloc
GlobalHandle
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
InterlockedIncrement
ReadFile
SetFilePointer
SetEndOfFile
GetThreadLocale
GetCPInfo
GetOEMCP
RtlUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
ExitProcess
HeapReAlloc
VirtualAlloc
GetTimeFormatA
GetDateFormatA
GetSystemTimeAsFileTime
HeapSize
SetStdHandle
GetFileType
GetACP
LCMapStringA
LCMapStringW
GetStdHandle
VirtualFree
HeapDestroy
HeapCreate
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetStringTypeA
GetTimeZoneInformation

user32

DefWindowProcA
GetDlgCtrlID
PtInRect
CopyRect
AdjustWindowRectEx
RegisterClassA
GetClassInfoA
GetClassInfoExA
CreateWindowExA
GetMenuItemCount
GetMenuItemID
GetSubMenu
GetMenu
GetClientRect
SetForegroundWindow
MapWindowPoints
GetMessagePos
GetMessageTime
UnhookWindowsHookEx
DestroyWindow
GetTopWindow
GetDlgItem
GetForegroundWindow
GetWindowTextA
RemovePropA
GetPropA
SetPropA
GetClassNameA
GetClassLongA
GetCapture
WinHelpA
LoadIconA
CallWindowProcA
ShowWindow
GetSysColorBrush
LoadCursorA
DestroyMenu
UnregisterClassA
GetWindowRect
TabbedTextOutA
DrawTextA
DrawTextExA
GrayStringA
ClientToScreen
GetSysColor
CheckMenuItem
EnableMenuItem
GetMenuState
ModifyMenuA
GetParent
GetFocus
LoadBitmapA
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
ValidateRect
GetCursorPos
GetKeyState
IsWindowVisible
GetActiveWindow
GetMessageA
CallNextHookEx
SetWindowsHookExA
SetCursor
EnableWindow
IsWindowEnabled
RegisterWindowMessageA
SendMessageA
PostMessageA
SetWindowPos
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindow
GetLastActivePopup
DispatchMessageA
TranslateMessage
PeekMessageA
ReleaseDC
SetWindowLongA
GetDC
GetWindowLongA
GetDesktopWindow
GetSystemMetrics
SetWindowTextA
GetWindowThreadProcessId
PostQuitMessage
MsgWaitForMultipleObjects
WaitForInputIdle
IsWindow
MessageBoxA

gdi32

DeleteObject
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
SelectObject
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
GetClipBox
SetMapMode
SetTextColor
SetBkColor
RestoreDC
ScaleWindowExtEx
DeleteDC
CreateBitmap
GetStockObject
GetDeviceCaps
SaveDC

winspool.drv

DocumentPropertiesA
ClosePrinter
OpenPrinterA

advapi32

RegCloseKey
RegQueryValueExA
RegQueryValueA
RegSetValueExA
RegOpenKeyExA
RegDeleteValueA
RegDeleteKeyA
RegOpenKeyA
RegCreateKeyExA
RegCreateKeyA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegEnumKeyA

oleaut32

VariantInit
VariantChangeType
VariantClear

shlwapi

PathFindExtensionA

oleacc

LresultFromObject
CreateStdAccessibleObject

Sections

.text
Size: 260KB - Virtual size: 258KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 12KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 40KB - Virtual size: 116KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

10be2a807a7a3deb71d83d6b8794102d

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

28:d2:02:39:8d:a9:29:fc:de:fa:15:a5:3c:d0:d7:80Certificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

Imports

lz32

version

kernel32

user32

gdi32

winspool.drv

advapi32

oleaut32

shlwapi

oleacc

Sections

.text Size: 260KB - Virtual size: 258KB

.rdata Size: 64KB - Virtual size: 63KB

.data Size: 12KB - Virtual size: 89KB

.rsrc Size: 40KB - Virtual size: 116KB

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

28:d2:02:39:8d:a9:29:fc:de:fa:15:a5:3c:d0:d7:80
Certificate

.text
Size: 260KB - Virtual size: 258KB

.rdata
Size: 64KB - Virtual size: 63KB

.data
Size: 12KB - Virtual size: 89KB

.rsrc
Size: 40KB - Virtual size: 116KB