c98b55ae1919646e0b511eba9d551b3b_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

c98b55ae1919646e0b511eba9d551b3b_JaffaCakes118
Size

50KB
MD5

c98b55ae1919646e0b511eba9d551b3b
SHA1

2429883a0f8e0a620c649687629aabc87bb75c8f
SHA256

ac75a8f627dbf81b56ef7f651ca5490890fcaa0c264dd98d663eb3162edd9a9f
SHA512

bb59020653cda8548e21d8d7f42dab86335e71a779705ab673bd2e7b882ac0f84b49a2e97b355e32c1d72b8a4aef09dbd4f862c7a9877b3a7236b4b19ea18d92
SSDEEP

1536:mZCZVbXQD6NuqKZ85+A/hebOnabp1htsqka6C+:mZCZZEaeuJgbpftTlI

Score

1^/10

Malware Config

Signatures

Files

c98b55ae1919646e0b511eba9d551b3b_JaffaCakes118
.exe windows:5 windows x86 arch:x86

982fa454babb1a29f06219ac5424cfc0

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5f:a2:0d:8e:f5:9b:9b:c8:7e:4d:99:10:f2:f5:a4:86
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

21/09/2009, 00:00

Not After

21/09/2010, 23:59

Subject

CN=Famatech International Corp.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Famatech International Corp.,L=Road Town,ST=Tortola,C=VG

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

u:\users\dmitry\projects\myutil\raddrv\mini\rsetup\objfre_wnet_x86\i386\rsetup.pdb

Imports

advapi32

RegCloseKey
RegOpenKeyA
RegDeleteValueA
CloseServiceHandle
OpenServiceW
OpenSCManagerW
ChangeServiceConfigW
StartServiceA
QueryServiceStatus
ControlService
DeleteService
RegSetValueExA
RegCreateKeyA
CreateServiceW
AdjustTokenPrivileges
OpenProcessToken
LookupPrivilegeValueA
IsValidSecurityDescriptor
SetSecurityDescriptorOwner
SetSecurityDescriptorDacl
AddAccessAllowedAce
IsValidSid
GetLengthSid
InitializeAcl
InitializeSecurityDescriptor
RegSetKeySecurity
RegOpenKeyExA
RegEnumKeyExA

kernel32

CloseHandle
GetProcAddress
GetModuleHandleA
GetVersionExA
GetVersion
LoadLibraryA
WideCharToMultiByte
MultiByteToWideChar
GetModuleFileNameA
GetModuleFileNameW
GetLastError
FreeLibrary
GetLocaleInfoA
WriteFile
SetFilePointer
GetCommandLineW
TerminateProcess
GetCurrentProcess
LeaveCriticalSection
OpenProcess
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetSystemTimeAsFileTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCommandLineA
HeapFree
HeapAlloc
GetProcessHeap
GetStartupInfoA
HeapReAlloc
ExitProcess
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
TlsAlloc
SetLastError
TlsFree
TlsSetValue
TlsGetValue
HeapDestroy
HeapCreate
VirtualFree
RtlUnwind
VirtualQuery
VirtualAlloc
GetACP
GetOEMCP
GetCPInfo
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetStdHandle
VirtualProtect
GetSystemInfo
FlushFileBuffers
EnterCriticalSection
DeleteCriticalSection
Sleep
InterlockedExchange
InitializeCriticalSection
GetCurrentProcessId

shell32

ShellExecuteW
ShellExecuteA

Sections

.text
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

982fa454babb1a29f06219ac5424cfc0

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

5f:a2:0d:8e:f5:9b:9b:c8:7e:4d:99:10:f2:f5:a4:86Certificate

Extended Key Usages

Key Usages

Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

shell32

Sections

.text Size: 39KB - Virtual size: 39KB

.data Size: 3KB - Virtual size: 10KB

.rsrc Size: 2KB - Virtual size: 1KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

5f:a2:0d:8e:f5:9b:9b:c8:7e:4d:99:10:f2:f5:a4:86
Certificate

.text
Size: 39KB - Virtual size: 39KB

.data
Size: 3KB - Virtual size: 10KB

.rsrc
Size: 2KB - Virtual size: 1KB