daae2bc3222a174e70dfa15c43beddb1_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

daae2bc3222a174e70dfa15c43beddb1_JaffaCakes118
Size

65KB
MD5

daae2bc3222a174e70dfa15c43beddb1
SHA1

5b5a7ed718c58fb1c62b7bdbdde304c639b45379
SHA256

1d8ca00f8932eb66061feb63708ab447884aea889c63622f4c435072a7ec4b3c
SHA512

afffddf26ecd52d6c3455d72b9c73d140b9b81b60cc4188382146f241ded0e1c390001ec075b5903a70bee93dd67db908c75c5f3cb6907a07b96632390fe3591
SSDEEP

768:9FPzmfeuGnbZa0JBiwQg5wZwv02AZbnGjf+3OFNHH4LFnoL9atl:9Jm3EZa0JkwwQ02ABoPUFnoI

Score

1^/10

Malware Config

Signatures

Files

daae2bc3222a174e70dfa15c43beddb1_JaffaCakes118
.exe windows:4 windows x86 arch:x86

7963ceeabe98b60340fce6e61aef8bbb

Code Sign

01
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

01/08/1996, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

20:ca:f3
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

11/01/2005, 23:22

Not After

10/02/2007, 16:18

Subject

CN=Integrated Search Technologies,OU=Secure Application Development,O=Integrated Search Technologies,L=Montreal,ST=Quebec,C=CA

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

wininet

InternetOpenA
InternetCloseHandle
InternetOpenUrlA
InternetReadFile

shlwapi

SHDeleteValueA
SHSetValueA
SHDeleteKeyA
SHGetValueA

user32

EnumWindows
PostMessageA
FindWindowA
GetWindowThreadProcessId

msvcrt

_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
_except_handler3
??1type_info@@UAE@XZ
_onexit
__dllonexit
_CxxThrowException
strchr
strncpy
strncmp
strtok
??2@YAPAXI@Z
??3@YAXPAX@Z
sprintf
isspace
__CxxFrameHandler
memset
strrchr
_stricmp

mfc42

ord2818
ord5710
ord5683
ord4278
ord3790
ord353
ord3176
ord1979
ord858
ord939
ord356
ord540
ord800
ord535
ord940
ord537
ord860
ord668
ord665
ord1980
ord2393
ord5583
ord3181
ord354
ord2781
ord2770
ord4058

kernel32

GetStartupInfoA
GetModuleHandleA
lstrcpyA
lstrcatA
DeleteFileA
CreateMutexA
GetLastError
Sleep
GetWindowsDirectoryA
SetErrorMode
LoadLibraryExA
RemoveDirectoryA
HeapAlloc
SetLastError
HeapFree
WideCharToMultiByte
OpenProcess
WaitForSingleObject
TerminateProcess
CloseHandle
FreeLibrary
LoadLibraryA
GetProcAddress

advapi32

RegOpenKeyExA
RegEnumKeyA
RegQueryInfoKeyA
RegEnumValueA
RegDeleteValueA
RegCloseKey
RegEnumKeyExA
RegDeleteKeyA

shell32

SHGetSpecialFolderPathA
ShellExecuteA

ole32

OleUninitialize
OleInitialize

Sections

.text
Size: 40KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

7963ceeabe98b60340fce6e61aef8bbb

Code Sign

01Certificate

0aCertificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

20:ca:f3Certificate

Extended Key Usages

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88Certificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

Imports

wininet

shlwapi

user32

msvcrt

mfc42

kernel32

advapi32

shell32

ole32

Sections

.text Size: 40KB - Virtual size: 38KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 12KB - Virtual size: 9KB

01
Certificate

0a
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

20:ca:f3
Certificate

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

.text
Size: 40KB - Virtual size: 38KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 12KB - Virtual size: 9KB