dae10fc5e665bd5d51fb3310ee4e957d_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

dae10fc5e665bd5d51fb3310ee4e957d_JaffaCakes118
Size

293KB
MD5

dae10fc5e665bd5d51fb3310ee4e957d
SHA1

a1d236e6976a172b99e14339bd5bd19832639460
SHA256

99c58296ac07e46762e79fdd6d9bb747c8b40a022c55beba8137b9ae52cbaf34
SHA512

74199984759844a83f5483d2d130cf713bcfe0f125b57738b28836e80be9c10d8db299b7e856b48213d80986adced4ba241f1ce1994557bfa4ef956504788b5c
SSDEEP

6144:Cn8USaQSwQTPuB6hrW/pMtOtRw7+URMzp:CnNx1P5S5Ua1

Score

1^/10

Malware Config

Signatures

Files

dae10fc5e665bd5d51fb3310ee4e957d_JaffaCakes118
.exe windows:4 windows x86 arch:x86

794560fcecb0ac307269329fd0a16f56

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

44:c6:5a:9f:82:11:ad:8c:98:78:70:ae:db:24:2a:bf
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

01/03/2006, 00:00

Not After

29/02/2008, 23:59

Subject

CN=ActivIdentity,OU=Digital ID Class 3 - Netscape Object Signing+OU=Product Group,O=ActivIdentity,L=Fremont,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ackpbsc

_KPBAuthDestroyPreferenceObject@4
_KPBAuthSetPreferenceDWORD@12
_KPBAuthSystemEvent@4
_KPBAuthSetPreferenceSTR@16
_KPBAuthCreatePreferenceObject@4

aclog

aclogLogBin
aclogLog
aclogTrace

aclibeay

ord281
ord151
ord2186

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationA

mfc80

ord6286
ord5331
ord6297
ord1580
ord911
ord2272
ord1249
ord907
ord3850
ord6021
ord1248
ord1247
ord2346
ord5320
ord1181
ord3255
ord297
ord266
ord265
ord781
ord2131
ord2322
ord1482
ord2468
ord5403
ord2469
ord1024
ord2248
ord762
ord572
ord2372
ord4035
ord760
ord3022
ord1084
ord4066
ord5469
ord4038
ord4014
ord6278
ord3801
ord6276
ord4326
ord2063
ord2018
ord5583
ord3806
ord1010
ord5102
ord6219
ord5382
ord3832
ord1920
ord2931
ord5224
ord5226
ord3948
ord4568
ord5230
ord5213
ord5566
ord2537
ord2731
ord2835
ord4307
ord2714
ord2838
ord2540
ord2646
ord2533
ord3718
ord3719
ord3709
ord2644
ord3949
ord4481
ord4261
ord3333
ord566
ord426
ord757
ord663
ord4541
ord3683
ord304
ord310
ord784
ord578
ord869
ord1191
ord1185
ord1187
ord764
ord1207

msvcr80

?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
_decode_pointer
_onexit
_lock
__dllonexit
_encode_pointer
_unlock
_except_handler4_common
strcat_s
_crt_debugger_hook
_mbsnbcpy_s
_lrotl
strchr
strcpy_s
isprint
_localtime64_s
strftime
_mktime64
_mbsnbcmp
memchr
memcpy
strlen
_mbsnbcnt
_mbslen
sprintf_s
memcmp
_strdup
sprintf
_invoke_watson
_mbsrchr
_controlfp_s
_invalid_parameter_noinfo
??0exception@std@@QAE@ABV01@@Z
_CxxThrowException
memset
strcpy
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
_purecall
__CxxFrameHandler3
free
malloc
_mbscmp
_setmbcp
strcat

kernel32

WaitForMultipleObjects
CreateEventA
DeleteCriticalSection
ReleaseMutex
CreateThread
Sleep
lstrlenA
GlobalAlloc
GlobalUnlock
GlobalLock
CreateMutexA
OpenEventA
SetProcessShutdownParameters
InitializeCriticalSection
LocalFree
lstrcmpA
WaitForSingleObject
GetModuleHandleA
FileTimeToSystemTime
GetExitCodeProcess
CreateProcessA
GetStartupInfoA
GetSystemDirectoryA
GetModuleFileNameA
GetCurrentThreadId
GetExitCodeThread
DuplicateHandle
GetCurrentProcessId
RaiseException
InterlockedCompareExchange
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
ResetEvent
EnterCriticalSection
LeaveCriticalSection
LocalAlloc
GetVersionExA
GetCurrentProcess
CloseHandle
LoadLibraryA
InterlockedExchange
MultiByteToWideChar
WideCharToMultiByte
GetLastError
GetVersion
SetEvent
GetACP
GetLocaleInfoA
GetThreadLocale
FreeLibrary
GetProcAddress

user32

PostThreadMessageA
PeekMessageA
FindWindowA
CreateWindowExA
SetWindowLongA
DispatchMessageA
GetMessageA
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
PostQuitMessage
LockWorkStation
GetClipboardData
DefWindowProcA
MessageBeep
ExitWindowsEx
SetTimer
KillTimer
PostMessageA
DestroyWindow
IsClipboardFormatAvailable
MessageBoxA

advapi32

OpenProcessToken
RegCreateKeyExA
RegDeleteValueA
RegDeleteKeyA
RegSetValueExA
RegOpenKeyA
SetUserFileEncryptionKey
RegEnumKeyA
RegConnectRegistryA
RegOpenKeyExA
RegQueryValueExA
GetTokenInformation
RegCloseKey

comctl32

ord17

ole32

CoInitialize
CoGetClassObject
CoCreateGuid
StringFromGUID2
CoUninitialize

msvcp80

?_Xran@_String_base@std@@SAXXZ
?_Xlen@_String_base@std@@SAXXZ

Sections

.text
Size: 127KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 121KB - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 39KB - Virtual size: 62KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

794560fcecb0ac307269329fd0a16f56

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

44:c6:5a:9f:82:11:ad:8c:98:78:70:ae:db:24:2a:bfCertificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

Imports

ackpbsc

aclog

aclibeay

wtsapi32

mfc80

msvcr80

kernel32

user32

advapi32

comctl32

ole32

msvcp80

Sections

.text Size: 127KB - Virtual size: 126KB

.rdata Size: 121KB - Virtual size: 120KB

.data Size: 4KB - Virtual size: 5KB

.rsrc Size: 39KB - Virtual size: 62KB

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

44:c6:5a:9f:82:11:ad:8c:98:78:70:ae:db:24:2a:bf
Certificate

.text
Size: 127KB - Virtual size: 126KB

.rdata
Size: 121KB - Virtual size: 120KB

.data
Size: 4KB - Virtual size: 5KB

.rsrc
Size: 39KB - Virtual size: 62KB