d565e4a600ddef17ba8de9b029ef58fe_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

d565e4a600ddef17ba8de9b029ef58fe_JaffaCakes118
Size

615KB
MD5

d565e4a600ddef17ba8de9b029ef58fe
SHA1

105f6c42b5abd9af235babc625ab2b76796a76af
SHA256

2366c947e10204cd1ec4b13e51a796f0bb916a774584daa024675ea691149ec8
SHA512

2f2ee64e37c8881785fac14224f61f14ad1726c33a442887d2e2fe7bc42f22f0ef0dea07e693fc76c2ac88ea0dea101def611d7bfdbb3768e9b2fc02aa75c0fa
SSDEEP

12288:J463QSOvKxIOK1AMkKMC1VeTBh1mRHzYMB:JjOCxjpKt1VeK

Score

1^/10

Malware Config

Signatures

Files

d565e4a600ddef17ba8de9b029ef58fe_JaffaCakes118
.exe windows:4 windows x86 arch:x86

a852942e8591ee85f9363a8dd1747896

Code Sign

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

30/05/2000, 10:48

Not After

30/05/2020, 10:48

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

30/05/2000, 10:48

Not After

30/05/2020, 10:48

Subject

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

c5:74:8d:95:0b:58:55:c8:f1:29:13:00:ca:a2:1e:91
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

08/04/2015, 00:00

Not After

07/04/2016, 23:59

Subject

CN=PLANETA SOFT,O=PLANETA SOFT,POSTALCODE=196143,STREET=42 ul.Ordzhonikidze,L=St. Petersburg,ST=St. Petersburg region,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

73:76:8b:7b:35:21:bb:0a:94:6c:ff:bf:8b:0c:72:a7:e5:83:89:22
Signer

Actual PE Digest

73:76:8b:7b:35:21:bb:0a:94:6c:ff:bf:8b:0c:72:a7:e5:83:89:22

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

user32

SetScrollRange
GetInternalWindowPos
CloseClipboard
GetKeyNameTextA
CreateMDIWindowW
ShowWindowAsync
AdjustWindowRect
SetPropW
OemKeyScan
GetSubMenu
GetMenuInfo
GetWindowContextHelpId
BroadcastSystemMessageExA
RedrawWindow
GetDCEx
LoadMenuW
LoadAcceleratorsA
SetDeskWallpaper
EnableMenuItem
EnumPropsA
GetClassWord
SendMessageW
SendMessageTimeoutW
ExitWindowsEx
ShowStartGlass
DrawMenuBar
GetWindowTextLengthA
GetMenuItemInfoW
DefFrameProcA
DrawTextW
DrawStateW
CharUpperBuffW
SetSystemCursor
OemToCharW
InvalidateRect
GetMessagePos
GetRawInputDeviceInfoA
CloseDesktop
SetPropA
DrawAnimatedRects
EnumDisplaySettingsW
SetWindowPos
GetFocus
EnumClipboardFormats
InsertMenuItemA
DrawEdge
BroadcastSystemMessageA
GetAsyncKeyState
SetUserObjectInformationA
PostThreadMessageA
GetUpdateRect
GetAltTabInfoA
SetWindowTextW
DrawCaptionTempA
ChangeDisplaySettingsW
RemovePropW
MenuWindowProcA
GetWindowTextLengthW
CheckMenuRadioItem
ReleaseDC
SetForegroundWindow
LoadImageA
LoadIconA
GetMessageA
UnloadKeyboardLayout
GetClipCursor
GetClassLongW
SetThreadDesktop
DlgDirListW
MessageBoxExW
AnyPopup
DrawCaption
AppendMenuA

kernel32

MapViewOfFileEx
FindNextVolumeMountPointA
LZOpenFileW
lstrlen
GetDiskFreeSpaceExA
WriteConsoleOutputAttribute
LCMapStringA
GetNamedPipeHandleStateA
GetModuleFileNameW
FindNextFileW
GetConsoleCursorMode
InitializeCriticalSectionAndSpinCount
Beep
SetThreadAffinityMask
WriteConsoleOutputW
GetBinaryTypeA
UnregisterWaitEx
CreateJobObjectA
IsBadWritePtr
lstrlenA
LocalSize
GetProfileSectionA
SuspendThread
GetConsoleMode
GetVersionExA
LockFile
InterlockedDecrement
SleepEx
SetHandleCount
ChangeTimerQueueTimer
CreateTimerQueue
CreateDirectoryA
QueueUserWorkItem
GetConsoleKeyboardLayoutNameA
CreateMemoryResourceNotification
GetDiskFreeSpaceA
EnumSystemLocalesA
GetDefaultCommConfigW
RestoreLastError
DeleteVolumeMountPointA
GetPrivateProfileSectionW
GetVolumePathNamesForVolumeNameA
OpenEventA
GetLongPathNameW
UnlockFile
RequestDeviceWakeup
GlobalWire
LZRead
GetCPInfoExA
SetDefaultCommConfigA
QueryActCtxW
WritePrivateProfileSectionW
lstrcpy
GetConsoleFontInfo
FreeUserPhysicalPages
PeekConsoleInputA
CreateNamedPipeW
GetTickCount
GetCommMask
LoadResource
SetFileApisToANSI
AddAtomA
CreateWaitableTimerA
EnumDateFormatsExA
GetCommModemStatus
RtlUnwind
GetFileAttributesExA
GetLastError
MapViewOfFileEx
TransactNamedPipe
VirtualQuery
LoadLibraryA
LocalAlloc
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

comdlg32

dwLBSubclass
FindTextA
ChooseFontA
ReplaceTextW

oleaut32

VarDecFix

shell32

SHInvokePrinterCommandW

winspool.drv

DeletePrintProvidorA
AbortPrinter
SetPrinterA
EnumPrintProcessorDatatypesA

gdi32

GetLayout
EngGradientFill
GetTextExtentExPointI
EnumMetaFile

version

VerQueryValueA
VerQueryValueW

comctl32

UninitializeFlatSB
ShowHideMenuCtl
CreatePropertySheetPageW

Exports

Exports

��ӭ ftN��8>��@@�-m��'��M�b�3z<Z*�E��R�O:��q��om[��"@ݞ�[��+��H�X�ڰ�z�q�B��50h��v ��b�"��bR/o�co��#n��b��<�7)Y:i.=�==k6��'V0ȼ��EAf)��SB��B$�*b3��T��]��*��T4�i��y� ��&[�NԄd�8��9|�|� Am� BUH�X�8%UL��U��0�ʃ�'YKb��G �v��-�G�h��C�%S��M��LI[��ørG��xn/�f�ўg��9��-��7�r�o��ϫ�N��m�� q��?��w5{�Z8 *a�3�jB��ɪ@r��Oksļ� �5��>*pee��=��ȡ`��Ӯ�]es�f�~��W�� 9��%��@P��|LH3�f��jYZ�1�3�p��Q��|��ŠHʱL[&WM{��H?&��1��E��|��2�/��2a];� ��l�]�G��)��fi��92w��4YA��e��n��F>��+�얠��>2��JS>G$��.;bJP6��G�4��{,��!{�2��ߖ�D��oٜKc��Au��_�[�+'N�� X��ʣ��UVk�ApId�w�"�4,�ʓs��R��-K③�m�<��ۆy�U�pe��ń5�˞ �c[��,��vr��(j��Z�{_'̎)ϝH+"�Z]�wk irP��8��M~��#9�%�'��T�?��TXy�k9oè�)�3�_��K��f��+?��QZ��D� ��Aܪ��\�E�`��g%�+��ɋ�5�P�`A��%��ܶ0�{=p��v�qk��X��K��<�hjp��P��V�B%n�T,�<�� ^��g��b��u��yڭ<Y�֦)��Uy|R�H.}.�ȫ}bq��zO1&]5tQ��šPp;��U��#wT�_�i+��{�5�!�2�̐��Ǖӫ�x�MVȍ��B��;l7��v�t��D �&e��X�@âK�m}�/7��號 ��2B$�_�$�ر}bO�X(�ye��Z��Z@ /][1Y{��G��&�x�;��5Sѧ��Fx2 S 9:Vq�!s7��.(uz·�_� $^�ݘ�я��\��y��k��q�iX#�WӫB��S��.W��ώ��X`��(��O=뉙hz�.�[��g��^�8��Z�|A�PM��Cs�|Ց3R�Ӧۏ�pE& ��SYûF�DJ%4��]��,�Oy%W�w�CxZ%��C�-��[f��k~��#W�O~'s��'��7k#ĸK��{�+[.J�d�t�s5��$��*v�T��B�Z��;=��`��O��u��O��P�@p�� Q�FY�Z�U[G)?$��Y��y��~��:2W�ԖG��~��gg��%1��{�I;��ɽ��k��,�!ꇢyK"P��R��u�d%�٥�`�~.~h��X�'99gg��T� t��G|n)��0q b��:��]A+��V��&��!X�b�lSt��LP[��]I�ϋ��4�9��=s&(�`C ��,�-ϑ��؄��x`��MO��y"i?�q��`Gߎ�y��ŀ�_�Ì= �a��ߠ��UP��jO{�\!�q�+�w&a�&6c!��EAtUS�Ca�B'J��v�K��$��͹0�ۿ!߳c�2.��/�V�)�tQ=� ��y��ݟQ��c��(nG �K��}rd�)��ޏZ��A��A�M �b��7wZ�֪�`fQ�@nM�{��06�F��)�y( ��/m��K�;!.`+�pM=1��~�l��/ԡ�(��l&p�H�"(kG�b��7��!b�x��gg�x;��ENc��V�yl�� h��%��5�3׭��R�P��I�8� �ۅ��uR��Z�-r��S?�|��@�q m��_b��[�K_�\�-(� XV�Ym}߭�P��u'E+�ZX��^[<{��e,�]��˜�6��,U��'�z�u�c-�(��lJ��+X,R��;ll��o�N'��hȈ}<d�yp��!ǽ�� 0��fI�꬞_�H��'��K��)��с|J�X~G��^�pE�gB��'��~81~��ߪ�Yқ��57A�m.�檡�8��U�ζvC��z[�x4�0�vܖY�C$jt�[�"Az;z�Ð� '�V%m�6e��&��|�C|2��𘲑\��͢�.�|��2�?y��3 l�Q��2 �d�t�"�V��`��$��z[̬[�p� C�9�(ٿ~<�� P�m>��B��|�8��v��Þtt[V�!��WWGNS�m��N 0�Լ��ד)M3�%p�:��S�<��)�p}Ǡ��>�S��8Wզ��@��0�q9��oe�yB0h"�]I�KUG��-��ƥ��ǎ��?`�YWe��MQP��4�I9��R�h��Q�A��m��p2�w\��ll�gY\�D��>p]��&qy�h56��S��>__e� 2鈱tlW�h�9U�U��e <�"��\��p��SN��ʹ��,��/r>�z�A� ��#��U�\��xQ�!�L<#w1w=�Ș̆�QS��gK�Z,�8Q��(j��Jp��-��T!z�OIǕ2{O��Ώ�m82f±!z.�:�J{��u�Z��f�=��G��>"ǰl �[�9t��B�ZL�I�n��Y�S7ai꼮��S@��{�ïܚ�@��J�A�S?]�jXY�K��۽J��

Sections

CODE
Size: 442KB - Virtual size: 442KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 1KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text0
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text1
Size: 63KB - Virtual size: 62KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a852942e8591ee85f9363a8dd1747896

Code Sign

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate

Extended Key Usages

Key Usages

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22Certificate

Key Usages

01Certificate

Key Usages

c5:74:8d:95:0b:58:55:c8:f1:29:13:00:ca:a2:1e:91Certificate

Extended Key Usages

Key Usages

73:76:8b:7b:35:21:bb:0a:94:6c:ff:bf:8b:0c:72:a7:e5:83:89:22Signer

Headers

File Characteristics

Imports

user32

kernel32

comdlg32

oleaut32

shell32

winspool.drv

gdi32

version

comctl32

Exports

Exports

Sections

CODE Size: 442KB - Virtual size: 442KB

.data Size: 22KB - Virtual size: 22KB

BSS Size: - Virtual size: 1KB

.idata Size: 4KB - Virtual size: 4KB

.text0 Size: 16KB - Virtual size: 16KB

.tls Size: 512B - Virtual size: 24B

.text1 Size: 63KB - Virtual size: 62KB

.reloc Size: 5KB - Virtual size: 5KB

.rsrc Size: 53KB - Virtual size: 53KB

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22
Certificate

01
Certificate

c5:74:8d:95:0b:58:55:c8:f1:29:13:00:ca:a2:1e:91
Certificate

73:76:8b:7b:35:21:bb:0a:94:6c:ff:bf:8b:0c:72:a7:e5:83:89:22
Signer

CODE
Size: 442KB - Virtual size: 442KB

.data
Size: 22KB - Virtual size: 22KB

BSS
Size: - Virtual size: 1KB

.idata
Size: 4KB - Virtual size: 4KB

.text0
Size: 16KB - Virtual size: 16KB

.tls
Size: 512B - Virtual size: 24B

.text1
Size: 63KB - Virtual size: 62KB

.reloc
Size: 5KB - Virtual size: 5KB

.rsrc
Size: 53KB - Virtual size: 53KB