c1fbeaf991f372b7295216734e6b24d1_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

c1fbeaf991f372b7295216734e6b24d1_JaffaCakes118
Size

2.6MB
MD5

c1fbeaf991f372b7295216734e6b24d1
SHA1

a1fb34983d5e05ac728cc91eb0cbad0243d2f443
SHA256

d829162e99bf7e92fef3241b7ec1b4091114f5e0556dea7b24157678c776ec38
SHA512

0c25dfca005b4d6e928c6919b5115f34e0b3fbd89963fbbd8cef7109497e4b35b9bc9fdf29b5a27ee1efdcbbe8ea9873f29fb871f6a3f77f9ee0598c9823b1a5
SSDEEP

49152:lVacGCYToKVsPHvuCuuJW1IhVI3CSuFv9tqKXMDZbPQCvHWiL87s:/TYUP6IhVI3CSutXyxl8A

Score

1^/10

Malware Config

Signatures

Files

c1fbeaf991f372b7295216734e6b24d1_JaffaCakes118
.exe windows:4 windows x86 arch:x86

c67edf531bdc750370ea2ec071cb0cfa

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:c9:02:d0:26:e3:12:44:c1:25:99:67:71:c9:dc:01
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

16/01/2008, 00:00

Not After

22/02/2011, 23:59

Subject

CN=TeamViewer GmbH,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TeamViewer GmbH,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

f3:8d:24:45:76:fe:5b:13:aa:8b:a9:35:43:0c:4e:7e:4d:ce:ae:d8
Signer

Actual PE Digest

f3:8d:24:45:76:fe:5b:13:aa:8b:a9:35:43:0c:4e:7e:4d:ce:ae:d8

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\TeamViewer\TeamViewer\qs_release\TeamViewer.pdb

Imports

comctl32

ImageList_ReplaceIcon
ImageList_SetBkColor
ImageList_Create
ImageList_Remove
InitCommonControlsEx
ImageList_LoadImageW

crypt32

CryptVerifyMessageSignature
CertGetNameStringA
CertFreeCertificateContext
CertGetNameStringW

imagehlp

ImageGetCertificateHeader
ImageGetCertificateData
ImageEnumerateCertificates

iphlpapi

GetAdapterIndex
DeleteIPAddress
GetAdaptersInfo

mpr

WNetCloseEnum
WNetOpenEnumW
WNetEnumResourceW

kernel32

GetCurrentThread
GetProcAddress
SetUnhandledExceptionFilter
FileTimeToLocalFileTime
DeleteFileA
FindFirstFileA
CreateFileA
FindNextFileA
OpenProcess
GlobalFree
WritePrivateProfileStringW
DeviceIoControl
CreateThread
ResumeThread
SetThreadPriority
CreateEventW
GetOverlappedResult
lstrcmpW
VirtualAlloc
GetVersionExA
GetACP
GetLocaleInfoA
GetThreadLocale
TlsAlloc
TlsGetValue
TlsSetValue
SystemTimeToFileTime
WaitForMultipleObjects
SetWaitableTimer
CreateWaitableTimerA
GetFileTime
SetFileTime
FormatMessageA
TerminateProcess
UnhandledExceptionFilter
IsDebuggerPresent
GetTimeFormatA
GetDateFormatA
GetCommandLineA
GetStartupInfoA
GetFileType
GetStdHandle
VirtualQuery
ExitProcess
RtlUnwind
LCMapStringA
GetStringTypeA
ExitThread
TlsFree
HeapCreate
GetTimeZoneInformation
SetHandleCount
SetFilePointer
GetOEMCP
GetConsoleCP
GetConsoleMode
FreeEnvironmentStringsA
GetEnvironmentStrings
GetUserDefaultLCID
QueryPerformanceCounter
WideCharToMultiByte
InterlockedExchange
LoadLibraryA
GetSystemDirectoryA
GetWindowsDirectoryA
GetModuleHandleA
CompareStringA
GetLocalTime
CompareFileTime
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
FindClose
SetErrorMode
FreeLibrary
DeleteCriticalSection
ReadFile
GetFileSize
FlushFileBuffers
WriteFile
LocalFree
GetCurrentProcessId
GetModuleFileNameA
GetCommandLineW
ReleaseMutex
InterlockedDecrement
VirtualFree
InterlockedIncrement
InitializeCriticalSection
GlobalUnlock
GlobalLock
GlobalAlloc
SetProcessShutdownParameters
MulDiv
CreateMutexA
GetLastError
Sleep
HeapAlloc
LoadResource
LockResource
SizeofResource
FlushInstructionCache
RaiseException
LeaveCriticalSection
EnterCriticalSection
SetLastError
HeapFree
GetTickCount
GetProcessHeap
GetSystemTimeAsFileTime
CloseHandle
ReleaseSemaphore
DuplicateHandle
CreateSemaphoreA
WaitForSingleObject
SetEvent
GetCurrentProcess
CreateEventA
GetCurrentThreadId
HeapDestroy
EnumSystemLocalesA
HeapReAlloc
HeapSize
InterlockedCompareExchange
IsValidLocale
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
SetEnvironmentVariableA
SetEndOfFile
IsProcessorFeaturePresent
ResetEvent

user32

DrawFocusRect
FrameRect
ClientToScreen
DestroyCursor
GetSystemMenu
GetWindowPlacement
DestroyAcceleratorTable
SetWindowPlacement
SetRectEmpty
GetCapture
GetMessagePos
GetNextDlgTabItem
GetSysColor
EndDeferWindowPos
DrawEdge
BeginDeferWindowPos
FlashWindow
GetDialogBaseUnits
ScreenToClient
DeferWindowPos
MapDialogRect
SetCapture
ReleaseCapture
GetShellWindow
GetMenu
PostQuitMessage
MessageBoxA
GetAsyncKeyState
GetKeyState
GetFocus
ToUnicode
GetKeyboardState
ToAscii
CloseClipboard
SetClipboardData
CreateWindowExA
PtInRect
CreatePopupMenu
CreateMenu
IsMenu
ChangeClipboardChain
SetClipboardViewer
SendInput
EnumWindows
CloseDesktop
GetUserObjectInformationW
GetThreadDesktop
WindowFromPoint
SetThreadDesktop
OpenInputDesktop
GetWindowDC
GetIconInfo
GetCursorInfo
CallNextHookEx
UnhookWindowsHookEx
MessageBeep
SetScrollPos
GetMenuItemInfoW
DestroyIcon
SetCursorPos
SetCursor
CreateIconIndirect
GetDlgItemTextA
CharLowerW
ScrollWindowEx
InvalidateRgn
SetScrollInfo
RedrawWindow
GetCursorPos
EqualRect
GetGUIThreadInfo
GetWindowThreadProcessId
GetForegroundWindow
BlockInput
EndDialog
ReleaseDC
UnionRect
CharUpperW
OpenClipboard
RegisterWindowMessageW
InflateRect
IntersectRect
SetRect
EndPaint
BeginPaint
AdjustWindowRect
GetActiveWindow
ShowScrollBar
GetSystemMetrics
CopyRect
SetForegroundWindow
SetParent
OffsetRect
UpdateWindow
FillRect
GetDlgItem
BringWindowToTop
GetDesktopWindow
GetDlgCtrlID
SetWindowRgn
DestroyMenu
SetFocus
CheckMenuRadioItem
RemoveMenu
GetSubMenu
EnableMenuItem
CheckMenuItem
GetDC
TrackPopupMenuEx
KillTimer
GetParent
DestroyWindow
SetTimer
GetClientRect
IsWindowVisible
TranslateMessage
InvalidateRect
SetWindowPos
MapWindowPoints
GetWindowRect
GetWindow
ShowWindow
MoveWindow
IsWindow
GetMenuStringW
OpenDesktopW
GetScrollInfo
UnregisterClassA
EmptyClipboard

gdi32

SelectPalette
RealizePalette
SetStretchBltMode
GetObjectType
GetSystemPaletteEntries
GetDIBits
DPtoLP
RoundRect
MoveToEx
LineTo
MaskBlt
CreatePatternBrush
PatBlt
SetDIBitsToDevice
Ellipse
GetDeviceCaps
SetTextColor
StrokeAndFillPath
EndPath
BeginPath
SetBkMode
GetPixel
SetBkColor
CreateBitmap
Rectangle
CreatePen
CreateSolidBrush
CombineRgn
CreateRectRgn
CreateRoundRectRgn
GetStockObject
BitBlt
SelectObject
StretchBlt
CreateCompatibleDC
DeleteDC
CreatePalette
SetPixel
SetViewportOrgEx
SetBrushOrgEx
CreateCompatibleBitmap
CreateDIBSection
DeleteObject

advapi32

SetSecurityDescriptorDacl
RegCloseKey
CryptAcquireContextA
CryptReleaseContext
CryptGenRandom
ImpersonateLoggedOnUser
DuplicateToken
RegSetValueExA
RegEnumValueW
RegEnumKeyExA
RegEnumValueA
RegOpenKeyW
CreateProcessAsUserW
SetEntriesInAclW
SetNamedSecurityInfoW
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
LookupPrivilegeValueW
AdjustTokenPrivileges
DuplicateTokenEx
SetTokenInformation
RevertToSelf
OpenProcessToken
InitializeSecurityDescriptor

shell32

SHGetSpecialFolderLocation
CommandLineToArgvW
ord680

ole32

CoInitialize
RegisterDragDrop
CoTaskMemAlloc
ReleaseStgMedium
OleInitialize
RevokeDragDrop
CoCreateInstance
CoTaskMemFree
StringFromGUID2
CoCreateGuid
CoUninitialize
CoTaskMemRealloc

oleaut32

VarUI4FromStr

shlwapi

PathCompactPathW

wsock32

bind
listen
accept
connect
getsockname
getpeername
send
__WSAFDIsSet
recvfrom
WSAGetLastError
select
recv
inet_ntoa
htons
sendto
socket
ntohs
ioctlsocket
htonl
WSAStartup
WSACleanup
shutdown
closesocket
gethostname
inet_addr
gethostbyname
setsockopt

wininet

InternetConnectW
HttpSendRequestA
InternetGoOnlineA
HttpQueryInfoA
InternetErrorDlg
InternetReadFile
HttpOpenRequestA
HttpAddRequestHeadersA
HttpSendRequestExA
InternetWriteFile
HttpEndRequestA
InternetQueryOptionW
InternetCloseHandle
InternetOpenW
InternetSetOptionW

Sections

.text
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 400KB - Virtual size: 399KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 67KB - Virtual size: 277KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 343KB - Virtual size: 343KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c67edf531bdc750370ea2ec071cb0cfa

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

25:c9:02:d0:26:e3:12:44:c1:25:99:67:71:c9:dc:01Certificate

Extended Key Usages

Key Usages

f3:8d:24:45:76:fe:5b:13:aa:8b:a9:35:43:0c:4e:7e:4d:ce:ae:d8Signer

Headers

File Characteristics

PDB Paths

Imports

comctl32

crypt32

imagehlp

iphlpapi

mpr

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

wsock32

wininet

Sections

.text Size: 1.8MB - Virtual size: 1.8MB

.rdata Size: 400KB - Virtual size: 399KB

.data Size: 67KB - Virtual size: 277KB

.tls Size: 512B - Virtual size: 2B

.rsrc Size: 343KB - Virtual size: 343KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

25:c9:02:d0:26:e3:12:44:c1:25:99:67:71:c9:dc:01
Certificate

f3:8d:24:45:76:fe:5b:13:aa:8b:a9:35:43:0c:4e:7e:4d:ce:ae:d8
Signer

.text
Size: 1.8MB - Virtual size: 1.8MB

.rdata
Size: 400KB - Virtual size: 399KB

.data
Size: 67KB - Virtual size: 277KB

.tls
Size: 512B - Virtual size: 2B

.rsrc
Size: 343KB - Virtual size: 343KB