d1f5ce6b23351677e54a245f46a9f8d2_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

d1f5ce6b23351677e54a245f46a9f8d2_JaffaCakes118
Size

257KB
MD5

d1f5ce6b23351677e54a245f46a9f8d2
SHA1

0d5c6749401248284767f16df92b726e727718ca
SHA256

57cb8f01cf553c3886760180d1a74839f2f676640115504485aca9692f577acc
SHA512

960e90894e7bedcc89894e77e57e8ee0c99dd2c530d02665e8bbd3a1793eccc1e295c5923d1f37c757fa1158097fbaae70898c16052882d3d210c29ea801b3ba
SSDEEP

6144:GHp/r0YSOJ0K5q0+S2M1evzug/xHvo6+A7sm:GHp/rrS60KIRpkyzumxHYXm

Score

1^/10

Malware Config

Signatures

Files

d1f5ce6b23351677e54a245f46a9f8d2_JaffaCakes118
.dll windows:5 windows x86 arch:x86

1a0c818fc42ed5fa0e3f4bc887fae294

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:06:94:2d:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:02

Not After

25/07/2013, 19:12

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

aa:ac:24:06:15:f6:d0:78:d8:32:4d:84:36:8a:62:19:5a:35:57:98
Signer

Actual PE Digest

aa:ac:24:06:15:f6:d0:78:d8:32:4d:84:36:8a:62:19:5a:35:57:98

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\office\Target\msishared\x86\ship\0\CustomActions\mainca.PDB

Imports

advapi32

RegCloseKey
RegSetValueExA
RegQueryValueExA
RegCreateKeyExA
CloseServiceHandle
RegOpenKeyExA
RegQueryValueExW
RegOpenKeyExW
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
RegEnumValueW
RegQueryInfoKeyA
RegEnumKeyExW
OpenSCManagerA
ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
OpenSCManagerW
ConvertStringSecurityDescriptorToSecurityDescriptorA
RegDeleteKeyA
RegEnumKeyExA
ControlService
QueryServiceStatus
OpenServiceW
EnumDependentServicesW
StartServiceA
RegSetValueExW
RegCreateKeyExW
CryptReleaseContext
CryptGenRandom
CryptAcquireContextA
RegDeleteValueW
RegDeleteKeyW
RegQueryInfoKeyW
StartServiceW

kernel32

HeapFree
lstrcmpiW
GetEnvironmentVariableW
GetShortPathNameW
FreeLibrary
GetProcAddress
LoadLibraryW
GetLocalTime
CompareStringW
lstrlenW
Sleep
LocalFree
GetCurrentProcess
GetVersion
CopyFileW
lstrcmpA
lstrlenA
GetExitCodeProcess
CreateProcessW
GetSystemTime
GetSystemDirectoryA
GetTickCount
CompareStringA
GetCurrentProcessId
SetLastError
HeapReAlloc
GlobalAddAtomW
GlobalFindAtomW
ExitProcess
CreateFileW
ReadFile
CloseHandle
GetLastError
InterlockedIncrement
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleHandleW
RaiseException
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
RtlUnwind
GetCommandLineA
GetCurrentThreadId
HeapSize
LocalAlloc
OpenEventW
GetSystemDefaultLangID
FlushFileBuffers
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetConsoleMode
GetConsoleCP
SetFilePointer
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringA
InitializeCriticalSectionAndSpinCount
LoadLibraryA
InterlockedExchange
WriteFile
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
GetStdHandle
LCMapStringW
GetModuleHandleA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetSystemTimeAsFileTime
QueryPerformanceCounter
VirtualFree
HeapDestroy
HeapCreate
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetModuleFileNameA
GetSystemDirectoryW
HeapAlloc
GetProcessHeap
lstrcmpW
WaitForSingleObject
CreateFileA
DeleteCriticalSection
GetStartupInfoA
GetFileType
InterlockedDecrement
WideCharToMultiByte
MultiByteToWideChar
FindClose
FindFirstFileW
SetHandleCount

msi

ord124
ord8
ord158
ord159
ord31
ord144
ord160
ord117
ord166
ord118
ord171
ord73
ord32
ord26
ord125
ord121
ord103
ord34
ord17
ord116
ord64
ord51
ord77
ord150
ord204
ord67
ord49
ord50
ord163
ord47
ord139
ord62
ord80
ord145
ord74
ord61
ord138
ord143

ole32

CoCreateInstance
CoUninitialize
CoInitializeEx
CoInitialize
OleRun
CLSIDFromProgID
CLSIDFromString
CoTaskMemFree

oleaut32

SystemTimeToVariantTime
VarBstrFromDate
SysAllocStringLen
SysFreeString
VariantClear

rpcrt4

UuidCreate
RpcStringFreeW
UuidToStringW
RpcBindingFree
RpcBindingFromStringBindingW
RpcStringBindingComposeW
NdrClientCall2

shlwapi

PathRemoveFileSpecW

user32

LoadKeyboardLayoutW
PostMessageA
SystemParametersInfoA
FindWindowA
GetSystemMetrics
MessageBoxW
RegisterWindowMessageA
MsgWaitForMultipleObjects
UnloadKeyboardLayout

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
VerQueryValueA

imm32

ImmInstallIMEW
ImmIsIME

crypt32

CryptSIPAddProvider
CryptSIPRemoveProvider

wintrust

WintrustRemoveActionID
WintrustAddActionID

Exports

Exports

ActivateChtIME
CAIMEJPCheckIMELatestVersion
CAIMEJPImmInstallIME
CAIMEJPInstallDictionary
CAIMEJPQueryPreInstallStatus
CAIMEJPRollBackInstallDictionary
CAIMEJPRollBackUninstallDictionary
CAIMEJPUninstall
CAIMEJPUninstallDictionary
CAIMEKRQueryPreInstallStatus
CAIMEKRUninstall
CAIMESCCheckUILanguage
CAIMESCCheckVersion
CAIMESCInstallMSPY
CAIMESCUninstallMSPY
CAOffDiag
CAOffice10Fix1
CASqm
ChainInstallMSDE
ChainProvision
CheckChtIMEVersion
CheckRebootRequired
CheckWDSVersion
CreateInjectorDownloadData
CryptReg
CryptUnreg
DestroyCache
DestroyUpgradedCache
DevDisable
DevRemoveFeatures
EnsureProductVersionJobOnTimerStart
ExecGrooveFirewall_Create
ExecGrooveFirewall_Remove
ExecGrvRelayFirewall_Create
ExecGrvRelayFirewall_Remove
ExecOneNoteFirewall_Create
ExecOneNoteFirewall_Remove
ExecOutlookFirewall_Create
ExecOutlookFirewall_Remove
FindRelatedOPP
GrooveAuditDetect
GrooveIconOverlay
IncrementInstallCount
InstallChtIME
IsIIS6PlusInstalled
KillJotSysTray
MarkTime
OfficeDataLockPermissions
OneNoteInstallPrinter
OneNoteUninstallPrinter
PrepareDestroyCache
RBInstallChtIME
RandomUUID
ReadBMSSCert
RegisterOneNoteCustomProperties
RegisterProdID
RemoveGrooveSearchRoots
RemoveOneNoteSearchProtocol
RestartSearchService
RestoreExtensionValue
RollbackRegistryOnUninstall
SchedGrooveFirewall_Install
SchedGrooveFirewall_Uninstall
SchedGrvRelayFirewall_Install
SchedGrvRelayFirewall_Uninstall
SchedOneNoteFirewall_Install
SchedOneNoteFirewall_Uninstall
SchedOutlookFirewall_Install
SchedOutlookFirewall_Uninstall
ScheduleRegistryOnUninstall
SetEvalProvisionInstallDateTimeProperty
SetISTABLETOS
SetSetupTypeB2B
SetSetupTypeClean
SetUsingUIInstallMode
SetupWRCDownload
ShutdownLOBiProcess
StartPreviouslyStoppedFastSearchServices
StartPreviouslyStoppedServices
StartWindowsSearchService
StopServicesFastSearch
StopServicesUsingSharePoint
UICaptionsChanged
UninstallChtIME
UninstallRemoveRegistry
UnregisterOneNoteCustomProperties
UpgradeSTS
ValidateProductID
WriteRegistryOnUninstall
XevRegisterAppForGenericXMLX64
XevRegisterAppForGenericXMLX86
XevRegisterX64
XevRegisterX86
XevUnregisterAppForGenericXMLX64
XevUnregisterAppForGenericXMLX86
XevUnregisterX64
XevUnregisterX86

Sections

.text
Size: 231KB - Virtual size: 231KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1a0c818fc42ed5fa0e3f4bc887fae294

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0Certificate

Extended Key Usages

Key Usages

61:01:cf:3e:00:00:00:00:00:0fCertificate

Extended Key Usages

Key Usages

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2Certificate

Extended Key Usages

Key Usages

61:06:94:2d:00:00:00:00:00:09Certificate

Extended Key Usages

Key Usages

aa:ac:24:06:15:f6:d0:78:d8:32:4d:84:36:8a:62:19:5a:35:57:98Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

msi

ole32

oleaut32

rpcrt4

shlwapi

user32

version

imm32

crypt32

wintrust

Exports

Exports

Sections

.text Size: 231KB - Virtual size: 231KB

.data Size: 6KB - Virtual size: 21KB

.rsrc Size: 3KB - Virtual size: 3KB

.reloc Size: 9KB - Virtual size: 8KB

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

61:01:cf:3e:00:00:00:00:00:0f
Certificate

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

61:06:94:2d:00:00:00:00:00:09
Certificate

aa:ac:24:06:15:f6:d0:78:d8:32:4d:84:36:8a:62:19:5a:35:57:98
Signer

.text
Size: 231KB - Virtual size: 231KB

.data
Size: 6KB - Virtual size: 21KB

.rsrc
Size: 3KB - Virtual size: 3KB

.reloc
Size: 9KB - Virtual size: 8KB