d41fcba5f795b997751bd97f1f4b4e17_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

d41fcba5f795b997751bd97f1f4b4e17_JaffaCakes118
Size

109KB
MD5

d41fcba5f795b997751bd97f1f4b4e17
SHA1

81886d1db908d9c0568767cdf4c9d8de670bd43e
SHA256

b7ed96a8da957a5658750fe4299a34f11727833f11c0854e8a1a2725285dba11
SHA512

2beb35c915d649bc42b3452b6035fb2bdd8f0dc37fc3bc72d5bb8773cba906340a0afe893ebc82ecf227de62dd01bd04d57f1f6755257158426bd6e3b7dfa481
SSDEEP

3072:B608fOpJZkZZcrponn3svEqILV0uVoSMGCDGWI9HFT:zkZZxMfuVoSj6IHFT

Score

1^/10

Malware Config

Signatures

Files

d41fcba5f795b997751bd97f1f4b4e17_JaffaCakes118
.exe windows:4 windows x86 arch:x86

6ee9b6cb8a399d3328a73ddea3d3c2a7

Code Sign

6d:bf:22:f9:41:d4:17:bb:44:54:f1:5a:f4:b9:f0:7c
Certificate

Issuer

CN=Root Agency

Not Before

28/09/2011, 20:05

Not After

31/12/2039, 23:59

Subject

CN=Joe's-Software-Emporium

db:fb:78:93:6b:56:28:ea:fb:d1:9d:19:15:a4:88:61:32:91:55:96
Signer

Actual PE Digest

db:fb:78:93:6b:56:28:ea:fb:d1:9d:19:15:a4:88:61:32:91:55:96

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

opengl32

glMapGrid2d
glPushClientAttrib
glIndexsv
glScissor
glMapGrid1d
glMapGrid2f
glGetError
glLoadIdentity
glTranslatef
glReadBuffer
glTexEnvf
glViewport
glTexGend
glScalef
glRotatef
glTranslated
glScaled
glRasterPos3sv
glTexEnvi
glGetTexGendv
glEvalCoord1dv
glCopyTexSubImage2D
glPolygonStipple
glColor3uiv
glTexCoord4d
glColor4ui
glColor4iv
glColor3i
glMapGrid1f
glGetDoublev
glColor4i
glRectfv
glTexGeni
glTexCoord1d
glLightModeliv

glu32

gluNewQuadric
gluDisk
gluPartialDisk
gluBeginSurface
gluTessEndPolygon
gluNurbsCurve
gluScaleImage
gluSphere
gluErrorUnicodeStringEXT
gluNewNurbsRenderer
gluBuild1DMipmaps
gluTessBeginContour
gluQuadricNormals
gluNewTess
gluNurbsCallback
gluGetString
gluDeleteTess
gluBeginCurve
gluNurbsSurface
gluTessVertex
gluUnProject
gluLoadSamplingMatrices

ole32

CreateDataAdviseHolder
CreateFileMoniker
StringFromCLSID
OleRegGetMiscStatus
CoGetTreatAsClass
CoCreateInstance
CoLoadLibrary
ProgIDFromCLSID
CoRegisterMallocSpy
CreatePointerMoniker
CoRegisterClassObject
CoRevokeClassObject
OleDoAutoConvert
CoGetMalloc
GetRunningObjectTable
GetClassFile
CoGetStandardMarshal
CreateClassMoniker
CoMarshalHresult
CreateBindCtx
CoUnmarshalHresult
CoGetClassObject
CoUninitialize
CoFileTimeNow

comctl32

ord15
ord4
CreateStatusWindowW
ord17
ord5
PropertySheetA
ord6
UninitializeFlatSB
ord14
ord3
ord16
CreateToolbarEx
InitCommonControlsEx
PropertySheetW
ord2
DestroyPropertySheetPage
ord13
CreatePropertySheetPageA

shlwapi

StrRStrIW
StrCSpnW
StrToIntA
StrRChrIW
StrStrA

msvcrt

_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__getmainargs
_except_handler3
_controlfp
_acmdln
exit
_XcptFilter
_exit
__set_app_type

kernel32

GetProcAddress
VirtualAlloc
ExitProcess
GetStartupInfoA
GetModuleHandleA

Sections

.text
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 90KB - Virtual size: 157KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

6ee9b6cb8a399d3328a73ddea3d3c2a7

Code Sign

6d:bf:22:f9:41:d4:17:bb:44:54:f1:5a:f4:b9:f0:7cCertificate

db:fb:78:93:6b:56:28:ea:fb:d1:9d:19:15:a4:88:61:32:91:55:96Signer

Headers

File Characteristics

Imports

opengl32

glu32

ole32

comctl32

shlwapi

msvcrt

kernel32

Sections

.text Size: 14KB - Virtual size: 13KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: 90KB - Virtual size: 157KB

6d:bf:22:f9:41:d4:17:bb:44:54:f1:5a:f4:b9:f0:7c
Certificate

db:fb:78:93:6b:56:28:ea:fb:d1:9d:19:15:a4:88:61:32:91:55:96
Signer

.text
Size: 14KB - Virtual size: 13KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 90KB - Virtual size: 157KB