c537ad6b878730ba88834bdb361e3bd7_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

c537ad6b878730ba88834bdb361e3bd7_JaffaCakes118
Size

595KB
MD5

c537ad6b878730ba88834bdb361e3bd7
SHA1

f6568b081dd562bcee939c9f691184b37ac10046
SHA256

4b6ffe7c8bb710c3b3e7eef0a79dae32ec9c3a4a3684d252caff3f8a33bd8856
SHA512

1e3b631f5178084ed49c5d22513c67aa6f8291aeb7a513f5aaeca44c83bd0bd0efb02c0d67b21e8829fe277c1befed01ae5e4bb5dca4befd2a28069e20451f05
SSDEEP

12288:/mDxN5Hef7wWHX+IuNEFVqhJuWYI17c8Z7zo1N92:YN5+f7t3cEFVq5Y0wu7zoI

Score

1^/10

Malware Config

Signatures

Files

c537ad6b878730ba88834bdb361e3bd7_JaffaCakes118
.exe windows:4 windows x86 arch:x86

423f1cd27245f479d4d05b04abc7274e

Code Sign

23:db:3e:48:84:b9:59:66:54:bd:b5:c1:86:35:03:1c
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

27-11-2016 00:00

Not After

27-11-2017 23:59

Subject

CN=Northcat Ltd,O=Northcat Ltd,POSTALCODE=CW9 6PX,STREET=10 Pheasant Drive\, Wincham,L=Northwich,ST=Cheshire,C=GB,2.5.4.18=#130743573920365058

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09-05-2013 00:00

Not After

08-05-2028 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31-12-2015 00:00

Not After

09-07-2019 18:40

Subject

CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c2:f1:76:09:0b:17:91:44:16:e5:de:31:0b:e3:83:ea:d5:ba:8b:f9:82:39:c2:64:9a:92:13:67:64:76:12:d5
Signer

Actual PE Digest

c2:f1:76:09:0b:17:91:44:16:e5:de:31:0b:e3:83:ea:d5:ba:8b:f9:82:39:c2:64:9a:92:13:67:64:76:12:d5

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegReplaceKeyW
RegCreateKeyExA
LogonUserW
RegSaveKeyW
OpenEventLogA
RegOpenKeyA
RegEnumKeyA
RegUnLoadKeyW
OpenServiceA
RegDeleteValueA

cmpbk32

PhoneBookEnumNumbers
PhoneBookFreeFilter
PhoneBookLoad
PhoneBookCopyFilter
PhoneBookEnumCountries

dsprop

CrackName
CheckADsError

untfs

Format
FormatEx
Recover

shlwapi

UrlUnescapeW
UrlHashA
UrlCombineW
PathCombineA
UrlGetLocationA
UrlIsA
UrlIsNoHistoryW
UrlCompareA
UrlCanonicalizeW
UrlGetPartW
PathCompactPathW
PathCommonPrefixW

crypt32

CertCompareCertificate
CertRemoveStoreFromCollection
CertOpenStore
CertSaveStore
CertAlgIdToOID
CertGetNameStringA
CertDeleteCRLFromStore
CertFindChainInStore
CertFindCRLInStore
CertNameToStrA
CertDuplicateCRLContext
CryptEnumOIDInfo

clusapi

ClusterEnum
CloseClusterNode
CloseCluster
CloseClusterGroup

kernel32

FindNextFileA
GetModuleHandleA
FindClose
WriteConsoleA
lstrcmpi
GetProcAddress
CreateProcessW
GetFileAttributesA
FindFirstFileW
CreateJobObjectA
GetConsoleTitleW
lstrcpy
CreateDirectoryA
OpenProcess
OpenThread
GetLogicalDriveStringsA
lstrcmpiA
WaitForSingleObject
DeleteFileA
GetCommandLineA
GetEnvironmentVariableW
GetPriorityClass
GetTempFileNameA
LoadLibraryA
CreateFileMappingW
FileTimeToSystemTime

Sections

.text
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE

.rdata
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.lock
Size: 523KB - Virtual size: 523KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

423f1cd27245f479d4d05b04abc7274e

Code Sign

23:db:3e:48:84:b9:59:66:54:bd:b5:c1:86:35:03:1cCertificate

Extended Key Usages

Key Usages

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate

Extended Key Usages

Key Usages

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77Certificate

Extended Key Usages

Key Usages

c2:f1:76:09:0b:17:91:44:16:e5:de:31:0b:e3:83:ea:d5:ba:8b:f9:82:39:c2:64:9a:92:13:67:64:76:12:d5Signer

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

cmpbk32

dsprop

untfs

shlwapi

crypt32

clusapi

kernel32

Sections

.text Size: 42KB - Virtual size: 42KB

.rdata Size: 21KB - Virtual size: 20KB

.lock Size: 523KB - Virtual size: 523KB

.rsrc Size: 2KB - Virtual size: 1KB

23:db:3e:48:84:b9:59:66:54:bd:b5:c1:86:35:03:1c
Certificate

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

c2:f1:76:09:0b:17:91:44:16:e5:de:31:0b:e3:83:ea:d5:ba:8b:f9:82:39:c2:64:9a:92:13:67:64:76:12:d5
Signer

.text
Size: 42KB - Virtual size: 42KB

.rdata
Size: 21KB - Virtual size: 20KB

.lock
Size: 523KB - Virtual size: 523KB

.rsrc
Size: 2KB - Virtual size: 1KB