d0961d3fd48237233d5df5a9963bcaf1_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

d0961d3fd48237233d5df5a9963bcaf1_JaffaCakes118
Size

490KB
MD5

d0961d3fd48237233d5df5a9963bcaf1
SHA1

2fbb772298581b93521c5deb680bfad53019c95e
SHA256

1544968912a1dfc6a942af61e6444dbaf689313b61eba4b5e5840016d7533c50
SHA512

bf7c29ef5f782052affdf9a021b270321daefd65ffc0f64e57ed01f90e0bdb7f42da934c3913b9245d5f527f1913b7854568d565da8b886608bef29471a8ea32
SSDEEP

12288:NNNtVTyDxLzO3fp5DsKtYsWUc955ZjlPBfNwsTlplUp1R1An8bo9iRz:NNNtVTyCRU955ZjRJ2Q8U9iRz

Score

1^/10

Malware Config

Signatures

Files

d0961d3fd48237233d5df5a9963bcaf1_JaffaCakes118
.exe windows:5 windows x86 arch:x86

a303600b363eb8773590e852c950fe80

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

29-01-1996 00:00

Not After

01-08-2028 23:59

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16-07-2004 00:00

Not After

15-07-2014 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:27:b0:14:00:be:ed:57:31:89:0f:c2:4b:5b:d4:cc
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

22-04-2008 00:00

Not After

22-04-2011 23:59

Subject

CN=Enigma Software Group USA\, LLC.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Enigma Software Group USA\, LLC.,L=Stamford,ST=Connecticut,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

d2:f1:48:55:f8:2f:9a:6a:38:b6:4e:15:2f:e1:cf:d3:b6:c6:22:97
Signer

Actual PE Digest

d2:f1:48:55:f8:2f:9a:6a:38:b6:4e:15:2f:e1:cf:d3:b6:c6:22:97

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DeleteCriticalSection
FlushInstructionCache
GetCurrentProcess
EnterCriticalSection
LeaveCriticalSection
InterlockedIncrement
InterlockedDecrement
GetModuleHandleW
GetModuleFileNameW
lstrlenW
GetLastError
InitializeCriticalSection
FreeLibrary
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
lstrcmpiW
GetProcAddress
SetFileAttributesW
ExpandEnvironmentStringsW
LocalFree
FormatMessageW
CloseHandle
WaitForSingleObject
CreateProcessW
LockResource
lstrlenA
DebugBreak
OutputDebugStringW
Sleep
GlobalLock
GlobalAlloc
SetEnvironmentVariableA
CompareStringW
CompareStringA
SetEndOfFile
CreateFileA
CreateFileW
GetTimeZoneInformation
GetLocaleInfoW
InitializeCriticalSectionAndSpinCount
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
RaiseException
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsValidCodePage
GetOEMCP
GetACP
GetModuleHandleA
GetModuleFileNameA
ExitProcess
GetStringTypeA
HeapCreate
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
FlushFileBuffers
SetFilePointer
ReadFile
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
GetConsoleMode
GetConsoleCP
WriteFile
GetStringTypeW
LCMapStringW
LCMapStringA
GetStartupInfoW
GetSystemTimeAsFileTime
GetCurrentThreadId
SetLastError
GetVersionExW
GlobalFree
GetLogicalDrives
DeleteFileW
RtlUnwind
GetCPInfo
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
HeapSize
HeapReAlloc
HeapDestroy
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
HeapAlloc
GetProcessHeap
HeapFree
InterlockedCompareExchange
GlobalUnlock
LocalAlloc
InterlockedExchange
LoadLibraryA
WideCharToMultiByte

user32

DispatchMessageW
TranslateMessage
GetMessageW
PeekMessageW
DestroyWindow
MessageBoxW
DefWindowProcW
CreateDialogParamW
RegisterClassExW
GetClassInfoExW
KillTimer
SetTimer
CallWindowProcW
CreateWindowExW
GetDlgItemTextW
wvsprintfW
EndPaint
BeginPaint
GetWindow
GetWindowLongW
MonitorFromWindow
GetMonitorInfoW
GetClientRect
MapWindowPoints
IsDialogMessageW
GetParent
SetDlgItemTextW
SendDlgItemMessageW
EnableWindow
InvalidateRect
UpdateWindow
ScreenToClient
GetWindowRect
SetWindowPos
MoveWindow
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
PostMessageW
EndDialog
DialogBoxParamW
SendMessageW
SetForegroundWindow
SetDlgItemTextA
ExitWindowsEx
PostQuitMessage
LoadCursorW
SetCursor
GetSystemMetrics
LoadImageW
GetDlgItem
CharNextW
SetWindowLongW
ShowWindow
UnregisterClassA

gdi32

SetBkMode
GetStockObject
DeleteDC

shell32

ShellExecuteW

ole32

CoInitialize
CoCreateInstance
CoTaskMemFree
CoTaskMemAlloc
CoTaskMemRealloc
CreateStreamOnHGlobal
CoUninitialize

oleaut32

VarUI4FromStr

shlwapi

PathStripPathW
PathFileExistsW
PathAddExtensionW
PathRemoveExtensionW

comctl32

InitCommonControlsEx

Sections

.text
Size: 214KB - Virtual size: 214KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 213KB - Virtual size: 212KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a303600b363eb8773590e852c950fe80

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bfCertificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

61:27:b0:14:00:be:ed:57:31:89:0f:c2:4b:5b:d4:ccCertificate

Extended Key Usages

Key Usages

d2:f1:48:55:f8:2f:9a:6a:38:b6:4e:15:2f:e1:cf:d3:b6:c6:22:97Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

ole32

oleaut32

shlwapi

comctl32

Sections

.text Size: 214KB - Virtual size: 214KB

.rdata Size: 36KB - Virtual size: 36KB

.data Size: 8KB - Virtual size: 16KB

.rsrc Size: 213KB - Virtual size: 212KB

.reloc Size: 12KB - Virtual size: 11KB

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

61:27:b0:14:00:be:ed:57:31:89:0f:c2:4b:5b:d4:cc
Certificate

d2:f1:48:55:f8:2f:9a:6a:38:b6:4e:15:2f:e1:cf:d3:b6:c6:22:97
Signer

.text
Size: 214KB - Virtual size: 214KB

.rdata
Size: 36KB - Virtual size: 36KB

.data
Size: 8KB - Virtual size: 16KB

.rsrc
Size: 213KB - Virtual size: 212KB

.reloc
Size: 12KB - Virtual size: 11KB