dd0d6c28904ffc246ffedc8e220e6487_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

dd0d6c28904ffc246ffedc8e220e6487_JaffaCakes118
Size

21KB
MD5

dd0d6c28904ffc246ffedc8e220e6487
SHA1

6adf7bf4efaeaf4919cca2c67925763a04d6a209
SHA256

49c7f8a1c665061e8bd3248821ea5d6b24a8113bb39da95efa7fc08b30eafa1d
SHA512

434e0c50a271077a6200d2bb6157a7e0230ec06e500c0cf3b3c1b248d09bceb760968c1b1358a8da1e88a30671f2a8e2ff68c90743bf9af8f0dcd16dedbd3147
SSDEEP

384:kD3P5KrMmHCMcvZmDB9nfePPL9ElPWebx8JN77hhFe:uKlJDzmRybe3hne

Score

1^/10

Malware Config

Signatures

Files

dd0d6c28904ffc246ffedc8e220e6487_JaffaCakes118
.dll windows:6 windows x86 arch:x86

4a759c7edaca6686af278c8e84bdb337

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

24:36:2d:f6:6c:f0:22:95:b2:dc:b1:cb:2a:13:4b:50
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

09-03-2017 00:00

Not After

08-05-2019 23:59

Subject

CN=pdfforge GmbH,O=pdfforge GmbH,L=Hamburg,ST=Hamburg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

24:36:2d:f6:6c:f0:22:95:b2:dc:b1:cb:2a:13:4b:50
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

09-03-2017 00:00

Not After

08-05-2019 23:59

Subject

CN=pdfforge GmbH,O=pdfforge GmbH,L=Hamburg,ST=Hamburg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23-12-2017 00:00

Not After

22-03-2029 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

1f:10:39:d4:8a:21:7f:08:75:c8:0a:6d:06:80:b3:43:eb:d5:a1:ca:0a:0e:91:b9:34:23:f0:a6:19:75:03:14
Signer

Actual PE Digest

1f:10:39:d4:8a:21:7f:08:75:c8:0a:6d:06:80:b3:43:eb:d5:a1:ca:0a:0e:91:b9:34:23:f0:a6:19:75:03:14

Digest Algorithm

sha256

PE Digest Matches

true

d3:a0:47:3d:7d:69:27:8c:40:db:1e:9e:7b:86:ef:24:ff:59:de:d2
Signer

Actual PE Digest

d3:a0:47:3d:7d:69:27:8c:40:db:1e:9e:7b:86:ef:24:ff:59:de:d2

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

G:\git\Internal\_bin\Win32\Release\encoding-conversion.pdb

Imports

kernel32

GetLastError
WideCharToMultiByte
MultiByteToWideChar
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter

vcruntime140

memset
_except_handler4_common
__std_type_info_destroy_list

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table
_cexit
_configure_narrow_argv
_seh_filter_dll
_initterm_e
_initterm
_execute_onexit_table
_initialize_narrow_environment

Exports

Exports

_SLConvertACPToUnicode@16
_SLConvertUTF16ToUTF8@16
_SLConvertUTF8ToUTF16@16
_SLConvertUnicodeToACP@16

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 916B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 308B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4a759c7edaca6686af278c8e84bdb337

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cbCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

24:36:2d:f6:6c:f0:22:95:b2:dc:b1:cb:2a:13:4b:50Certificate

Extended Key Usages

Key Usages

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cbCertificate

Extended Key Usages

Key Usages

24:36:2d:f6:6c:f0:22:95:b2:dc:b1:cb:2a:13:4b:50Certificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

1f:10:39:d4:8a:21:7f:08:75:c8:0a:6d:06:80:b3:43:eb:d5:a1:ca:0a:0e:91:b9:34:23:f0:a6:19:75:03:14Signer

d3:a0:47:3d:7d:69:27:8c:40:db:1e:9e:7b:86:ef:24:ff:59:de:d2Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

Exports

Exports

Sections

.text Size: 3KB - Virtual size: 3KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 512B - Virtual size: 916B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 308B

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

24:36:2d:f6:6c:f0:22:95:b2:dc:b1:cb:2a:13:4b:50
Certificate

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

24:36:2d:f6:6c:f0:22:95:b2:dc:b1:cb:2a:13:4b:50
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

1f:10:39:d4:8a:21:7f:08:75:c8:0a:6d:06:80:b3:43:eb:d5:a1:ca:0a:0e:91:b9:34:23:f0:a6:19:75:03:14
Signer

d3:a0:47:3d:7d:69:27:8c:40:db:1e:9e:7b:86:ef:24:ff:59:de:d2
Signer

.text
Size: 3KB - Virtual size: 3KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 512B - Virtual size: 916B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 308B