ddbf205afb6f153e4278b40389286331_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

ddbf205afb6f153e4278b40389286331_JaffaCakes118
Size

249KB
MD5

ddbf205afb6f153e4278b40389286331
SHA1

5910cfcccdd353e53909331c9766cb9fe366ad29
SHA256

13795362f5ea6235784d8234e31212d225bd4cb59834a445233d392ae7e09e8a
SHA512

5e7406ba0f3203785d4f945086205259dd05314d91cbc46dcd9813b927abea88f7b4c1a078aa1102a4c3b0bf34b5432764f8472824e31320234ffd304f93b498
SSDEEP

3072:vyy9GfkrJooooooN49wjBNFvYTnl/gp4pZvfEA0ZGfDPiqvu13mNS+Z5UkbIWG5M:vy5fkr349IFeh4a7b/G5C9

Score

1^/10

Malware Config

Signatures

Files

ddbf205afb6f153e4278b40389286331_JaffaCakes118
.exe windows:5 windows x86 arch:x86

01e1b3bf28f5225e2223c7beed0d5c43

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

01
Certificate

Issuer

CN=Ratmev Anike,O=Amoqk Ladtotbo Il,L=Runpit,ST=Tegutevmef,C=CN

Not Before

25/06/2015, 20:22

Not After

24/06/2016, 20:22

Subject

CN=Nyzys Otaile,O=Amoqk Ladtotbo Il,L=Runpit,ST=Tegutevmef,C=CN

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

fc:43:30:97:93:d5:55:88:26:1c:ad:9f:af:37:f4:54:c4:c5:15:e1
Signer

Actual PE Digest

fc:43:30:97:93:d5:55:88:26:1c:ad:9f:af:37:f4:54:c4:c5:15:e1

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
FreeLibrary
HeapDestroy
HeapSize
HeapReAlloc
WideCharToMultiByte
FindResourceExW
CreateFileA
WaitNamedPipeA
SetNamedPipeHandleState
CreateEventW
CreateThread
SetEvent
LocalFree
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
CreateMutexW
ReleaseMutex
FileTimeToLocalFileTime
FileTimeToSystemTime
GetModuleHandleA
DeviceIoControl
SetLastError
InterlockedIncrement
InterlockedDecrement
lstrcmpiW
RaiseException
ReadFile
InitializeCriticalSectionAndSpinCount
DecodePointer
UnhandledExceptionFilter
lstrlenA
ReadConsoleW
WriteConsoleW
SetStdHandle
SetFilePointerEx
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetConsoleMode
GetConsoleCP
GetFileType
GetOEMCP
GetACP
GetFileSize
FlushFileBuffers
WriteFile
CreateFileW
LockResource
GetCPInfo
LoadResource
SizeofResource
FindResourceW
HeapFree
GetProcessHeap
HeapAlloc
MultiByteToWideChar
GetCurrentProcess
IsWow64Process
Sleep
WaitForSingleObject
CloseHandle
TerminateProcess
GetLastError
GetLongPathNameW
GetModuleHandleW
GetModuleFileNameW
GetCurrentProcessId
GetCurrentThreadId
SetUnhandledExceptionFilter
TlsAlloc
IsValidCodePage
GetStdHandle
LCMapStringW
GetStartupInfoW
TlsFree
RtlUnwind
GetCommandLineW
ExitThread
GetModuleHandleExW
ExitProcess
GetSystemTimeAsFileTime
IsProcessorFeaturePresent
TlsGetValue
LoadLibraryExW
IsDebuggerPresent
OutputDebugStringW
EncodePointer
GetStringTypeW
TlsSetValue

user32

RegisterClassExW
CreateWindowExW
LoadCursorW
CharNextW
GetMessageW
TranslateMessage
DispatchMessageW
SetTimer
DefWindowProcW
KillTimer
PostQuitMessage
ShowWindow
UpdateWindow
LoadIconW

advapi32

CryptReleaseContext
CryptCreateHash
RegDeleteKeyW
StartServiceCtrlDispatcherW
StartServiceW
SetServiceStatus
RegisterServiceCtrlHandlerW
ChangeServiceConfigW
DeleteService
ControlService
CloseServiceHandle
ChangeServiceConfig2W
QueryServiceStatus
OpenServiceW
CreateServiceW
OpenSCManagerW
FreeSid
AllocateAndInitializeSid
RegQueryInfoKeyW
RegOpenKeyW
RegDeleteValueW
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegEnumKeyExW
LookupAccountSidW
CryptDestroyHash
CryptGetHashParam
CryptHashData
CryptAcquireContextW

ole32

CoTaskMemFree
CoCreateInstance
CoInitializeEx
CoUninitialize
CoCreateFreeThreadedMarshaler
CoTaskMemRealloc
CoTaskMemAlloc
OleRun

oleaut32

LoadTypeLi
LoadRegTypeLi
VarUI4FromStr
SysStringLen
VariantClear
SysAllocStringLen
SysFreeString
SysAllocString
GetErrorInfo

Sections

.text
Size: 191KB - Virtual size: 190KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 856B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

01e1b3bf28f5225e2223c7beed0d5c43

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

01Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

fc:43:30:97:93:d5:55:88:26:1c:ad:9f:af:37:f4:54:c4:c5:15:e1Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

ole32

oleaut32

Sections

.text Size: 191KB - Virtual size: 190KB

.rdata Size: 44KB - Virtual size: 44KB

.data Size: 7KB - Virtual size: 16KB

.rsrc Size: 1024B - Virtual size: 856B

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

01
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

fc:43:30:97:93:d5:55:88:26:1c:ad:9f:af:37:f4:54:c4:c5:15:e1
Signer

.text
Size: 191KB - Virtual size: 190KB

.rdata
Size: 44KB - Virtual size: 44KB

.data
Size: 7KB - Virtual size: 16KB

.rsrc
Size: 1024B - Virtual size: 856B