dd00004f12531594b1eee6908200ac65_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

dd00004f12531594b1eee6908200ac65_JaffaCakes118
Size

197KB
MD5

dd00004f12531594b1eee6908200ac65
SHA1

881348a5b4108723ba0221cdfa5b21dcd6daf4fc
SHA256

daf4633064afd521e3282555cf82913982cb9071ff594ab1b0e6bbbf94247587
SHA512

d602c953a60ade28c89a5fb867acd6a270c624697273db71df1d4cea898eed8ed93844130f555a5f04e1c95e80cc72efb31eabf98f6f745985cf1b3ffb502221
SSDEEP

6144:9AM2ogjOl7UuBUy1hrZyH1ZgUaLvj1eO9:9A18RUyUy1OcUaLJ9

Score

1^/10

Malware Config

Signatures

Files

dd00004f12531594b1eee6908200ac65_JaffaCakes118
.exe windows:4 windows x86 arch:x86

b4293e2ae736b04e899fc479e9dbc13e

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

36:19:cb:4e:08:3c:27:fa:d2:1e:d4:f6:4f:43:4b:67
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

14/08/2009, 00:00

Not After

15/08/2012, 23:59

Subject

CN=NPP GARANT-SERVICE,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=NPP GARANT-SERVICE,ST=N/A,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
VirtualProtect
GetProcAddress
HeapCreate
HeapDestroy
HeapFree
HeapAlloc
RtlUnwind
CreateFileA
LoadLibraryA
GetCurrentProcess
CloseHandle
LCMapStringA
ExitProcess

user32

CloseWindow
CreateWindowExA
CharLowerBuffA
SetWindowLongA
wsprintfA

advapi32

RegCloseKey
RegQueryValueA
RegDeleteKeyA
RegCreateKeyA
RegDeleteValueA
RegSetValueA
RegOpenKeyA
RegEnumValueA
RegEnumKeyA

Sections

.text
Size: 168KB - Virtual size: 172KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b4293e2ae736b04e899fc479e9dbc13e

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

36:19:cb:4e:08:3c:27:fa:d2:1e:d4:f6:4f:43:4b:67Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

Imports

kernel32

user32

advapi32

Sections

.text Size: 168KB - Virtual size: 172KB

.data Size: 8KB - Virtual size: 5KB

.rsrc Size: 8KB - Virtual size: 6KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

36:19:cb:4e:08:3c:27:fa:d2:1e:d4:f6:4f:43:4b:67
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

.text
Size: 168KB - Virtual size: 172KB

.data
Size: 8KB - Virtual size: 5KB

.rsrc
Size: 8KB - Virtual size: 6KB