d73b84035246fda138e8b272eae3b5eb_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

d73b84035246fda138e8b272eae3b5eb_JaffaCakes118
Size

876KB
MD5

d73b84035246fda138e8b272eae3b5eb
SHA1

7afcd4f752e8523d580a27a54e28d67bc0294449
SHA256

43b04ce9c075b5a93067588b5e394cfb508deb211100345f3c0cbf10c6f0e0ba
SHA512

d70f262736d6b5f2491ac682e8faf010f3e9a91a2330e2c27237aab61c6db82be76b779087dde367ef786e9c9c29f57507a3c9ca73a8ea3ebaa8784d7aec6996
SSDEEP

24576:8dw+vm2FnLZirvvA8l91kxaFqufQaaAv7EWBny9Y:8vxrirv/l91kgFmaacJ7

Score

1^/10

Malware Config

Signatures

Files

d73b84035246fda138e8b272eae3b5eb_JaffaCakes118
.exe windows:4 windows x86 arch:x86

ec9605398a0fd517e0ad80394889134f

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09/07/1999, 18:31

Not After

09/07/2019, 18:40

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

3d:49:cd:33:c1:1e:6c:1b:ba:e2:97:1e:37:76:c7:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

01/02/2008, 00:00

Not After

31/01/2009, 23:59

Subject

CN=InstallProvider Inc.,O=InstallProvider Inc.,POSTALCODE=DM,STREET=15 Cornwall Street,L=Roseau,ST=Dominica,C=DM

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathAppendA
PathIsUNCA
PathFileExistsA
StrFormatByteSize64A
StrChrIA
SHAutoComplete
StrSpnA
PathQuoteSpacesA
UrlIsOpaqueA
StrIsIntlEqualA
SHRegCreateUSKeyA
PathCommonPrefixA
StrCSpnA
SHIsLowMemoryMachine
StrRChrIA
PathStripToRootA
StrToIntExA
ColorHLSToRGB
PathSearchAndQualifyA
UrlGetLocationA
SHDeleteValueA
PathGetDriveNumberA
PathFindOnPathA
PathMakePrettyA
AssocQueryStringA
PathIsRelativeA
SHRegOpenUSKeyA
UrlCombineA

kernel32

lstrcmp
GetCPInfoExA
SetConsoleWindowInfo
SetCommMask
SetProcessShutdownParameters
SetConsoleTextAttribute
_hread
GetProfileIntA
WriteConsoleOutputAttribute
TlsSetValue
GetTempPathA
ExpandEnvironmentStringsA
GetStringTypeExA
SetConsoleCtrlHandler
lstrcmpi
SetMailslotInfo
WritePrivateProfileStringA
FindAtomA
SetCommTimeouts
GetPrivateProfileIntA
OpenSemaphoreA
InterlockedExchange
IsBadReadPtr
GetConsoleOutputCP
GetCurrentProcessId
SetDefaultCommConfigA
InterlockedCompareExchange
VirtualLock
Heap32ListNext
EnumResourceTypesA
FlushConsoleInputBuffer
CreateConsoleScreenBuffer
GetSystemTimeAdjustment
IsBadWritePtr
_llseek
SetSystemTime
WaitForSingleObject
GetNumberFormatA
FoldStringA
WriteConsoleInputA
GetShortPathNameA
LoadModule
EnumResourceLanguagesA
VirtualAlloc
SetEnvironmentVariableA
ResetEvent
_lread
CopyFileA
LocalFree
ReadProcessMemory
GetProcessAffinityMask
GetLogicalDriveStringsA
UnhandledExceptionFilter
GetCommandLineA
IsValidCodePage
UTRegister
FreeConsole
HeapDestroy
GetUserDefaultLangID
SetupComm
DuplicateHandle
ReadConsoleOutputA

Sections

.nofop
Size: 638KB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vyp
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.knehs
Size: 19KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xmt
Size: 512B - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.qzw
Size: 6KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.zuxy
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xuj
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.sxaz
Size: 48KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.jepgr
Size: 132KB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 18KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ec9605398a0fd517e0ad80394889134f

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1bCertificate

Extended Key Usages

Key Usages

3d:49:cd:33:c1:1e:6c:1b:ba:e2:97:1e:37:76:c7:0bCertificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

Imports

shlwapi

kernel32

Sections

.nofop Size: 638KB - Virtual size: 1.3MB

.vyp Size: 6KB - Virtual size: 8KB

.knehs Size: 19KB - Virtual size: 27KB

.xmt Size: 512B - Virtual size: 21KB

.qzw Size: 6KB - Virtual size: 15KB

.zuxy Size: 512B - Virtual size: 56B

.xuj Size: 512B - Virtual size: 24B

.sxaz Size: 48KB - Virtual size: 77KB

.jepgr Size: 132KB - Virtual size: 1.7MB

.rsrc Size: 18KB - Virtual size: 20KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

3d:49:cd:33:c1:1e:6c:1b:ba:e2:97:1e:37:76:c7:0b
Certificate

.nofop
Size: 638KB - Virtual size: 1.3MB

.vyp
Size: 6KB - Virtual size: 8KB

.knehs
Size: 19KB - Virtual size: 27KB

.xmt
Size: 512B - Virtual size: 21KB

.qzw
Size: 6KB - Virtual size: 15KB

.zuxy
Size: 512B - Virtual size: 56B

.xuj
Size: 512B - Virtual size: 24B

.sxaz
Size: 48KB - Virtual size: 77KB

.jepgr
Size: 132KB - Virtual size: 1.7MB

.rsrc
Size: 18KB - Virtual size: 20KB