dcd68e320cf9231e3875c59913628d51_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

dcd68e320cf9231e3875c59913628d51_JaffaCakes118
Size

876KB
MD5

dcd68e320cf9231e3875c59913628d51
SHA1

bf5a5d84297f23142252c624ebb71558ed7b2a3a
SHA256

cd89b2613ceaf283c647edd19f6ae5c3db9fcb8ce4a388ee2b53ecc8a724e799
SHA512

808277fbf4248825ac1dc47e55ce5964710b0d8128be0423df54307050e8f8f09c614ec025cd4f8c0c1c3c82b87f0a864ad93d9211d5ab17c146929eaf1dbae4
SSDEEP

24576:gSkUCHA2wDoym9LpEXzu780vNy0Z+978en:g2Crym99czi800xuen

Score

1^/10

Malware Config

Signatures

Files

dcd68e320cf9231e3875c59913628d51_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f2751568eb7dc161eb0b2d89d1e30bbd

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09/07/1999, 18:31

Not After

09/07/2019, 18:40

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

3d:49:cd:33:c1:1e:6c:1b:ba:e2:97:1e:37:76:c7:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

01/02/2008, 00:00

Not After

31/01/2009, 23:59

Subject

CN=InstallProvider Inc.,O=InstallProvider Inc.,POSTALCODE=DM,STREET=15 Cornwall Street,L=Roseau,ST=Dominica,C=DM

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

SHRegCreateUSKeyA
PathStripToRootA
HashData
UrlIsOpaqueA
SHRegOpenUSKeyA
StrChrIA
SHRegEnumUSKeyA
PathFindOnPathA
ColorHLSToRGB
PathIsFileSpecA
SHDeleteValueA
StrSpnA
StrFormatByteSize64A
PathMakePrettyA
PathGetDriveNumberA
PathQuoteSpacesA
StrToIntExA
SHRegWriteUSValueA
UrlGetLocationA
PathCommonPrefixA
UrlCombineA
StrRChrIA
PathRemoveBlanksA
PathFileExistsA
SHCreateStreamWrapper
PathIsUNCA
SHAutoComplete
PathAppendA
StrCSpnA
PathIsRelativeA
SHIsLowMemoryMachine

kernel32

GetProcessVersion
HeapDestroy
SetupComm
GetCommModemStatus
GetStringTypeExA
GlobalGetAtomNameA
AreFileApisANSI
QueryPerformanceCounter
SetFileApisToOEM
SearchPathA
SetSystemTime
GetCPInfoExA
QueueUserAPC
CreateFiber
LocalLock
GetPrivateProfileStructA
SetTapeParameters
WriteConsoleOutputAttribute
HeapCompact
GetCommState
FindResourceA
GetConsoleOutputCP
GetFileAttributesExA
FlushConsoleInputBuffer
GlobalAddAtomA
GetSystemTimeAdjustment
OpenSemaphoreA
GetCurrentThreadId
LockFileEx
DebugActiveProcess
LocalFree
GlobalLock
GetUserDefaultLangID
EnumResourceLanguagesA
GenerateConsoleCtrlEvent
GlobalFindAtomA
ReadConsoleOutputA
GetAtomNameA
SwitchToFiber
IsValidCodePage
TerminateThread
EraseTape
_hread
_lclose
WriteProfileStringA
FillConsoleOutputAttribute
WritePrivateProfileStringA
ExpandEnvironmentStringsA
GetTempPathA
FindFirstFileA
lstrcmp
LocalUnlock
CancelIo
IsBadWritePtr
IsBadHugeReadPtr
SetProcessShutdownParameters
LocalFileTimeToFileTime
EnumCalendarInfoA
PurgeComm

advapi32

RegSaveKeyA

Sections

.huh
Size: 638KB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.nsdoz
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.etg
Size: 19KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.hqna
Size: 512B - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.qdcvi
Size: 6KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.hwrib
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.sta
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.jup
Size: 48KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.denw
Size: 132KB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 18KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f2751568eb7dc161eb0b2d89d1e30bbd

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1bCertificate

Extended Key Usages

Key Usages

3d:49:cd:33:c1:1e:6c:1b:ba:e2:97:1e:37:76:c7:0bCertificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

Imports

shlwapi

kernel32

advapi32

Sections

.huh Size: 638KB - Virtual size: 1.3MB

.nsdoz Size: 6KB - Virtual size: 8KB

.etg Size: 19KB - Virtual size: 27KB

.hqna Size: 512B - Virtual size: 21KB

.qdcvi Size: 6KB - Virtual size: 15KB

.hwrib Size: 512B - Virtual size: 56B

.sta Size: 512B - Virtual size: 24B

.jup Size: 48KB - Virtual size: 77KB

.denw Size: 132KB - Virtual size: 1.7MB

.rsrc Size: 18KB - Virtual size: 20KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

3d:49:cd:33:c1:1e:6c:1b:ba:e2:97:1e:37:76:c7:0b
Certificate

.huh
Size: 638KB - Virtual size: 1.3MB

.nsdoz
Size: 6KB - Virtual size: 8KB

.etg
Size: 19KB - Virtual size: 27KB

.hqna
Size: 512B - Virtual size: 21KB

.qdcvi
Size: 6KB - Virtual size: 15KB

.hwrib
Size: 512B - Virtual size: 56B

.sta
Size: 512B - Virtual size: 24B

.jup
Size: 48KB - Virtual size: 77KB

.denw
Size: 132KB - Virtual size: 1.7MB

.rsrc
Size: 18KB - Virtual size: 20KB