d234ced0dee09bcc9a38d3b8398deeed_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

d234ced0dee09bcc9a38d3b8398deeed_JaffaCakes118
Size

425KB
MD5

d234ced0dee09bcc9a38d3b8398deeed
SHA1

107f63cb28ebc075da6eab04d3b091f53cbc094a
SHA256

911a6c42984d79be8eab2e797f885d5af6421ceefab57d3ab11ed2c814f697d6
SHA512

9e714e03cd8cf84496cc976dc09eff267798fe9d497db1e1421feee93ad93da2e5d4e60dee78e9b53675e49de13b6847e831bbf9784859187ecc65b9cae17562
SSDEEP

6144:TJ1aIMzxBVRfv2Gs75Pk0jU3r6+JHsoMqClrqqDL6DQZcOeCxp:dUIMzxBVVeNjUb1OHqyGqn636

Score

1^/10

Malware Config

Signatures

Files

d234ced0dee09bcc9a38d3b8398deeed_JaffaCakes118
.exe windows:6 windows x86 arch:x86

5d1a763b59b6df0582871e02ff6af2fa

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

70:a4:91:35:34:93:af:1c:af:19:81:7a:97:c8:e8:16
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

08/04/2009, 00:00

Not After

28/04/2010, 23:59

Subject

CN=Check Point Software Technologies Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Check Point Software Technologies Ltd.,L=Ramat-Gan,ST=Ramat-Gan,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

66:7b:0c:be:c8:00:ef:7f:47:1c:ea:e2:6c:91:3c:23:09:49:e2:5c
Signer

Actual PE Digest

66:7b:0c:be:c8:00:ef:7f:47:1c:ea:e2:6c:91:3c:23:09:49:e2:5c

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\builds\ZaffMain\builds\forcefield\Build\Release\ISWSVC.pdb

Imports

msvcr80

wcschr
strchr
_vsnprintf
_wtempnam
sprintf
_itow
_errno
_snprintf
_vsnwprintf
malloc
_time64
clock
_gmtime64
_itoa
memmove
wcsrchr
isdigit
_memicmp
srand
rand
strncpy
wcsncpy
??3@YAXPAX@Z
memset
__CxxFrameHandler3
memcpy
_controlfp_s
_invoke_watson
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
_except_handler4_common
_crt_debugger_hook
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
_wtoi
_wcsicmp
??0exception@std@@QAE@XZ
memmove_s
_beginthreadex
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABV01@@Z
_invalid_parameter_noinfo
??0exception@std@@QAE@ABQBD@Z
_purecall
free
??2@YAPAXI@Z
wcsstr
_wstat64i32
_CxxThrowException

ntdll

ZwQueryInformationProcess
ZwYieldExecution
ZwWaitForMultipleObjects
ZwQueryKey
RtlFreeUnicodeString
ZwOpenKey
ZwWaitForSingleObject
ZwCreateFile
ZwQueryInformationFile
ZwSetValueKey
ZwQueryValueKey
ZwSetInformationFile
ZwFlushBuffersFile
ZwWriteFile
ZwReleaseMutant
LdrGetProcedureAddress
LdrLoadDll
ZwFlushInstructionCache
ZwAllocateVirtualMemory
ZwQueryFullAttributesFile
RtlInitUnicodeString
ZwWriteVirtualMemory
ZwCreateEvent
ZwCreateKey
RtlFormatCurrentUserKeyPath
ZwOpenThread
ZwDelayExecution
ZwFreeVirtualMemory
ZwReadVirtualMemory
ZwQueryInformationThread
ZwProtectVirtualMemory
ZwSetEvent
ZwOpenFile
RtlGetVersion
ZwQueryVirtualMemory
ZwOpenEvent
ZwOpenMutant
ZwClose
ZwCreateMutant
ZwResetEvent

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

psapi

EnumProcesses

kernel32

SetEndOfFile
SetUnhandledExceptionFilter
Sleep
CloseHandle
OpenProcess
WaitForSingleObject
SetLastError
CreateEventW
CreateToolhelp32Snapshot
Process32FirstW
SetEvent
InterlockedCompareExchange
Process32NextW
WaitForMultipleObjects
ResetEvent
GetThreadPriority
SetProcessWorkingSetSize
GetCurrentThread
GetCurrentProcess
SetThreadPriority
GetLastError
GetTickCount
QueueUserAPC
DeviceIoControl
LoadLibraryW
FreeLibrary
SleepEx
GetVersion
TerminateProcess
OpenThread
DuplicateHandle
InterlockedExchange
GetModuleHandleW
DeleteFileW
CreateProcessW
GetExitCodeProcess
LocalFree
ResumeThread
GetStartupInfoA
UnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapAlloc
GetTempPathW
WaitForSingleObjectEx
HeapDestroy
HeapCreate
GetFileSizeEx
SystemTimeToFileTime
MoveFileExW
GetSystemTime
WriteFile
SetFilePointerEx
CompareFileTime
GetCommandLineW
ReadFile
GetEnvironmentVariableW
HeapFree
CreateFileW
CreateDirectoryW
ExitThread
GetLocalTime
ReleaseMutex
CreateMutexW
QueryPerformanceFrequency
GetComputerNameW
EnterCriticalSection
LeaveCriticalSection
DisconnectNamedPipe
DeleteCriticalSection
QueueUserWorkItem
CreateFileMappingW
RemoveDirectoryW
FindNextFileW
OutputDebugStringW
GetVersionExW
GetPrivateProfileStringW
GetPrivateProfileIntW
WideCharToMultiByte
WaitNamedPipeW
GetShortPathNameW
CompareStringW
CompareStringA
IsBadWritePtr
lstrcpynW
VerLanguageNameW
IsBadReadPtr
MapViewOfFile
UnmapViewOfFile
InitializeCriticalSection
GetExitCodeThread
CreateThread
ReadProcessMemory
GetFileSize
VirtualFree
VirtualAlloc
CopyFileW
GetCurrentDirectoryW
InterlockedIncrement
InterlockedDecrement
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
GetProcessAffinityMask
CreateNamedPipeW
ConnectNamedPipe
GetFileAttributesW
SearchPathW
GetWindowsDirectoryW
GetEnvironmentStringsW
SetEnvironmentVariableW
MultiByteToWideChar
GetModuleFileNameW
FindClose
FindFirstFileW
FlushFileBuffers
GetProcAddress
SetFileAttributesW

user32

GetUserObjectInformationW
CharLowerW
wsprintfW
CharUpperW
SetThreadDesktop
GetThreadDesktop
OpenDesktopW
CloseDesktop
GetDesktopWindow
FindWindowExW
CharLowerBuffA
OpenInputDesktop
CharUpperBuffW
CharUpperBuffA
RegisterWindowMessageW
MessageBoxW
MsgWaitForMultipleObjects
DispatchMessageW
TranslateMessage
PeekMessageW
CharLowerBuffW

advapi32

LookupPrivilegeValueW
RegOpenKeyExW
MakeAbsoluteSD
OpenProcessToken
AdjustTokenPrivileges
RegCreateKeyExW
RegCreateKeyW
RegOpenKeyW
ImpersonateNamedPipeClient
RevertToSelf
ImpersonateLoggedOnUser
LookupAccountNameW
GetAce
OpenThreadToken
AddAce
AllocateAndInitializeSid
SetSecurityDescriptorOwner
SetKernelObjectSecurity
SetSecurityDescriptorGroup
GetSecurityInfo
CreateProcessAsUserW
ConvertStringSidToSidW
EqualSid
SetThreadToken
DuplicateTokenEx
CreateRestrictedToken
SetSecurityInfo
GetSecurityDescriptorSacl
SetTokenInformation
GetTokenInformation
SetSecurityDescriptorSacl
SetSecurityDescriptorDacl
AddAuditAccessAce
AddAccessAllowedAce
InitializeAcl
InitializeSecurityDescriptor
RegisterServiceCtrlHandlerExW
SetServiceStatus
StartServiceCtrlDispatcherW
RegQueryValueExW
RegCloseKey
RegSetValueExW
ConvertSidToStringSidW
RegDeleteValueW
RegEnumValueW

msvcp80

?length@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@@Z
?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIABV12@I@Z
?resize@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXI@Z
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBG@Z
??$?8GU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
?rfind@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIGI@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@G@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@G@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGI@Z
??A?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEABGI@Z
?replace@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IIABV12@@Z
?insert@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IIG@Z
?insert@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IABV12@@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBG@Z
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z
?compare@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEHPBG@Z
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@@Z
?insert@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IPBG@Z
?swap@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXAAV12@@Z
?empty@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE_NXZ
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?clear@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXXZ
?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?rfind@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGI@Z
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??$?8GU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z
?erase@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@II@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?swap@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXAAV12@@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IG@Z
??A?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAGI@Z
?substr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE?AV12@II@Z
??0?$allocator@D@std@@QAE@ABV01@@Z
?deallocate@?$allocator@D@std@@QAEXPADI@Z
??0?$allocator@D@std@@QAE@XZ
?max_size@?$allocator@D@std@@QBEIXZ
?allocate@?$allocator@D@std@@QAEPADI@Z
?max_size@?$allocator@G@std@@QBEIXZ
?allocate@?$allocator@G@std@@QAEPAGI@Z
??0?$allocator@G@std@@QAE@ABV01@@Z
?deallocate@?$allocator@G@std@@QAEXPAGI@Z
??0?$allocator@G@std@@QAE@XZ
?size@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ
??$?9GU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIGI@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??$?HGU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBGABV10@@Z
??$?HGU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@0@Z
??$?HGU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@PBG@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??$?MGU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB
?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGI@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
?_Myptr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IBEPBDXZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
?empty@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE_NXZ
?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ
?_Myptr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@IBEPBGXZ
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IIPBD@Z

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

shlwapi

SHDeleteKeyW

crypt32

CertGetNameStringW
CryptHashPublicKeyInfo
CertCloseStore
CertOpenSystemStoreW
CertEnumCertificatesInStore
CertGetIssuerCertificateFromStore
CertFreeCertificateContext
CryptQueryObject

shell32

SHGetSpecialFolderPathW
CommandLineToArgvW

ole32

CoInitialize
CoUninitialize

Exports

Exports

_IswLog_FlushThread@4

Sections

.text
Size: 320KB - Virtual size: 316KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 88KB - Virtual size: 87KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5d1a763b59b6df0582871e02ff6af2fa

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

70:a4:91:35:34:93:af:1c:af:19:81:7a:97:c8:e8:16Certificate

Extended Key Usages

Key Usages

66:7b:0c:be:c8:00:ef:7f:47:1c:ea:e2:6c:91:3c:23:09:49:e2:5cSigner

Headers

File Characteristics

PDB Paths

Imports

msvcr80

ntdll

userenv

psapi

kernel32

user32

advapi32

msvcp80

version

shlwapi

crypt32

shell32

ole32

Exports

Exports

Sections

.text Size: 320KB - Virtual size: 316KB

.rdata Size: 88KB - Virtual size: 87KB

.data Size: 4KB - Virtual size: 3KB

.rsrc Size: 4KB - Virtual size: 3KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

70:a4:91:35:34:93:af:1c:af:19:81:7a:97:c8:e8:16
Certificate

66:7b:0c:be:c8:00:ef:7f:47:1c:ea:e2:6c:91:3c:23:09:49:e2:5c
Signer

.text
Size: 320KB - Virtual size: 316KB

.rdata
Size: 88KB - Virtual size: 87KB

.data
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 4KB - Virtual size: 3KB