d2f2542f827a37b37c6e734a09b4467a_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

d2f2542f827a37b37c6e734a09b4467a_JaffaCakes118
Size

1.6MB
MD5

d2f2542f827a37b37c6e734a09b4467a
SHA1

695e5b08cb86b7736fb29162f10a094f47779b46
SHA256

60502bede665c05d50b618209815acb89fc40faed5ae03b45574876ee0c3601f
SHA512

05b90dc91704162f9d73b8012cd8932109048ea8124990c9f79c5c51dea68ed4c7e09e755d864d6a5eca60a031eca0f7ace695fc5be207efa7781c3d5b4677f6
SSDEEP

49152:it2No3u+kvvJuwUIU/trJVxVNHhHZJy0zy1H:xo3u+GaIU/FjxbhHO0zyZ

Score

1^/10

Malware Config

Signatures

Files

d2f2542f827a37b37c6e734a09b4467a_JaffaCakes118
.exe windows:5 windows x86 arch:x86

9fad8673e56699b2469a7628edf40418

Code Sign

0d:2c:ac:cd:3e:9e:ec:06:73:84:10:ba:31:bf:65:95
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

31/01/2019, 00:00

Not After

03/02/2021, 12:00

Subject

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Flash Player,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

04/01/2017, 00:00

Not After

18/01/2028, 00:00

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a5:4d:52:c3:54:a9:42:be:02:f2:dd:a6:19:e2:39:20:58:5c:89:24
Signer

Actual PE Digest

a5:4d:52:c3:54:a9:42:be:02:f2:dd:a6:19:e2:39:20:58:5c:89:24

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\PC\source\repos\MFCEXE\Release\MFCEXE.pdb

Imports

kernel32

GetVolumeInformationA
GetOEMCP
GetCPInfo
SetErrorMode
FileTimeToLocalFileTime
GetFileAttributesExA
SystemTimeToTzSpecificLocalTime
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
WriteConsoleW
SetFilePointerEx
GetConsoleCP
SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
IsValidCodePage
FindNextFileA
FindFirstFileExA
GetTimeZoneInformation
GetStringTypeW
LCMapStringW
CompareStringW
GetFileType
GetStdHandle
HeapQueryInformation
GetModuleHandleExW
GetCommandLineW
GetCommandLineA
RtlUnwind
OutputDebugStringW
GetFullPathNameA
FlushFileBuffers
FindFirstFileA
FindClose
DeleteFileA
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetLocaleInfoW
GlobalFlags
LocalReAlloc
LocalAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSection
GlobalGetAtomNameA
GlobalFindAtomA
lstrcmpW
LoadLibraryA
GetSystemDirectoryW
EncodePointer
GetCurrentProcessId
GlobalAddAtomA
WritePrivateProfileStringA
GetPrivateProfileStringA
GetPrivateProfileIntA
CompareStringA
lstrcmpA
GlobalDeleteAtom
LoadLibraryExW
GetModuleFileNameA
FreeLibrary
GetVersionExA
GetCurrentThreadId
FindResourceA
FreeResource
FormatMessageA
MulDiv
LocalFree
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
LoadLibraryW
GetProcAddress
GetModuleHandleW
GetModuleHandleA
GetModuleFileNameW
SetLastError
OutputDebugStringA
GetACP
MultiByteToWideChar
UnmapViewOfFile
FileTimeToSystemTime
GetFileAttributesA
CreateDirectoryA
GetCurrentDirectoryA
LocalFileTimeToFileTime
SystemTimeToFileTime
SetFileTime
SetFilePointer
ReadFile
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
GetLastError
RaiseException
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
DecodePointer
WideCharToMultiByte
SetPriorityClass
SetFileAttributesA
CreateFileA
FindResourceW
lstrlenW
WinExec
CloseHandle
WriteFile
SizeofResource
LoadResource
Sleep
SetThreadPriority
GetCurrentThread
CreateFileW
ExitProcess
GetCurrentProcess
GetConsoleMode
LockResource

user32

LoadIconA
GetWindow
GetTopWindow
GetClassNameA
GetClassLongA
SetWindowLongA
PtInRect
CopyRect
MapWindowPoints
AdjustWindowRectEx
GetWindowRect
GetWindowTextA
RemovePropA
GetPropA
SetPropA
GetScrollPos
RedrawWindow
SetForegroundWindow
GetForegroundWindow
UpdateWindow
SetMenu
GetMenu
GetCapture
SetFocus
GetDlgCtrlID
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
SetWindowPos
IsChild
IsMenu
GetClassInfoExA
GetClassInfoA
RegisterClassA
CallWindowProcA
DefWindowProcA
GetMessageTime
GetMessagePos
RegisterWindowMessageA
GetSysColor
ScreenToClient
ClientToScreen
EndPaint
BeginPaint
ReleaseDC
IsDialogMessageA
TabbedTextOutA
GrayStringA
DrawTextExA
DrawTextA
UnhookWindowsHookEx
SendMessageA
IsIconic
EnableWindow
GetSystemMetrics
GetLastActivePopup
GetWindowThreadProcessId
MessageBoxA
SetCursor
PostQuitMessage
PostMessageA
CallNextHookEx
SetWindowsHookExA
GetCursorPos
ValidateRect
GetKeyState
IsWindowVisible
PeekMessageA
DispatchMessageA
TranslateMessage
GetMessageA
WinHelpA
MonitorFromWindow
GetMonitorInfoA
ShowWindow
CreateWindowExA
SetWindowTextA
DrawIcon
GetClientRect
LoadIconW
UnregisterClassA
wsprintfA
GetDesktopWindow
SendDlgItemMessageA
SetRectEmpty
OffsetRect
GetParent
GetSubMenu
GetMenuItemID
GetMenuItemCount
GetFocus
CheckMenuItem
EnableMenuItem
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
SetMenuItemInfoA
LoadBitmapW
IsWindow
DestroyWindow
CreateDialogIndirectParamA
EndDialog
GetDlgItem
GetNextDlgTabItem
GetActiveWindow
IsWindowEnabled
GetSysColorBrush
LoadCursorA
RealChildWindowFromPoint
SetTimer
KillTimer
CharUpperA
DestroyMenu
SetActiveWindow
GetWindowLongA
GetDC
InvalidateRect

gdi32

GetStockObject
PtVisible
RectVisible
RestoreDC
SaveDC
SelectObject
SetBkColor
SetMapMode
SetTextColor
GetObjectA
TextOutA
ExtTextOutA
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
OffsetViewportOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
GetClipBox
Escape
DeleteObject
CreateBitmap
GetDeviceCaps
DeleteDC

winspool.drv

OpenPrinterA
ClosePrinter
DocumentPropertiesA

advapi32

RegEnumValueA
RegQueryValueA
RegEnumKeyA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
RegQueryValueExA
RegOpenKeyExA
RegSetValueExA
RegCreateKeyA
RegCloseKey

shell32

SHChangeNotify
ShellExecuteA

shlwapi

PathFindFileNameA
PathIsUNCA
PathStripToRootA
PathFindExtensionA

ole32

CoCreateInstance
CoTaskMemFree
CoInitialize
CoUninitialize
CoCreateGuid

oleaut32

VariantChangeType
VariantClear
VariantInit
SysAllocStringLen
SysFreeString

wininet

InternetOpenUrlW
InternetReadFile
InternetCloseHandle
InternetOpenA

oleacc

CreateStdAccessibleObject
LresultFromObject

Sections

.text
Size: 226KB - Virtual size: 226KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 75KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 46KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9fad8673e56699b2469a7628edf40418

Code Sign

0d:2c:ac:cd:3e:9e:ec:06:73:84:10:ba:31:bf:65:95Certificate

Extended Key Usages

Key Usages

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5cCertificate

Extended Key Usages

Key Usages

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41Certificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

a5:4d:52:c3:54:a9:42:be:02:f2:dd:a6:19:e2:39:20:58:5c:89:24Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

shlwapi

ole32

oleaut32

wininet

oleacc

Sections

.text Size: 226KB - Virtual size: 226KB

.rdata Size: 75KB - Virtual size: 75KB

.data Size: 1.2MB - Virtual size: 1.2MB

.rsrc Size: 46KB - Virtual size: 45KB

.reloc Size: 15KB - Virtual size: 14KB

0d:2c:ac:cd:3e:9e:ec:06:73:84:10:ba:31:bf:65:95
Certificate

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

a5:4d:52:c3:54:a9:42:be:02:f2:dd:a6:19:e2:39:20:58:5c:89:24
Signer

.text
Size: 226KB - Virtual size: 226KB

.rdata
Size: 75KB - Virtual size: 75KB

.data
Size: 1.2MB - Virtual size: 1.2MB

.rsrc
Size: 46KB - Virtual size: 45KB

.reloc
Size: 15KB - Virtual size: 14KB