de8112218bba2334fcbc5c1d400cb005_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

de8112218bba2334fcbc5c1d400cb005_JaffaCakes118
Size

31KB
MD5

de8112218bba2334fcbc5c1d400cb005
SHA1

e497beec9e63959e2cdde33e2554a81be53b0981
SHA256

5314ff1f49a498544f8d4d3afdbc8e3536a958e7ba75e5dac1b8ccd183b62126
SHA512

b4f279e4495397a38a83373f4c90ad40605e1aa1e7821fbfcb4779d4266d24adff2731138af0b23fcba2f03750a0a3b1a5ff010a42da90d427e54a4aa4ad0ea0
SSDEEP

384:+TDbDEvbYAFy/6Z6Zfuc7BDgKaPsBXD6lVYg9MtIa9jbsuKStmE6wNvTLdYJLmQ:4bDQYd6ZmfjJg3eiWiMtHb/KStmEtgLr

Score

1^/10

Malware Config

Signatures

Files

de8112218bba2334fcbc5c1d400cb005_JaffaCakes118
.exe windows:5 windows x64 arch:x64

10afc90e59035551b6de2784fb57150c

Code Sign

18:23:2a:ce:52:10:a6:b0:4d:86:17:a5:00:40:af:4c
Certificate

Issuer

CN=deepxw Software,O=deepxw Software,1.2.840.113549.1.9.1=#1306646565707877

Not Before

18/01/2008, 16:00

Not After

31/12/2011, 16:00

Subject

CN=deepxw Software,O=deepxw Software,1.2.840.113549.1.9.1=#1306646565707877

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

53:7e:f3:53:d1:2b:07:77:43:4b:a0:76:35:33:2f:77:2e:fd:89:c6
Signer

Actual PE Digest

53:7e:f3:53:d1:2b:07:77:43:4b:a0:76:35:33:2f:77:2e:fd:89:c6

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

b:\tcpz_setup\x64\objfre_wnet_AMD64\TCPZ_Setup-x64.pdb

Imports

msvcrt

exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_commode
_fmode
__set_app_type
_cexit
_exit
_c_exit
_XcptFilter
__C_specific_handler
malloc
free
??3@YAXPEAX@Z
??2@YAPEAX_K@Z
_wcsicmp
_wcsnicmp
iswalpha
towupper
towlower
wcschr
_wcsdup
wprintf
wcsstr
memset

advapi32

GetSidSubAuthorityCount
RegOpenKeyW
RegDeleteKeyW
DuplicateTokenEx
OpenProcessToken
GetTokenInformation
GetSidSubAuthority
LookupPrivilegeValueW
AdjustTokenPrivileges
RegOpenKeyExW
RegQueryValueExW
RegCloseKey

kernel32

GetFullPathNameW
GetCurrentProcessId
LoadLibraryA
CreateProcessW
WaitForSingleObject
LoadLibraryW
GetProcAddress
GetStartupInfoA
lstrlenW
RtlLookupFunctionEntry
RtlVirtualUnwind
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
lstrcpynW
lstrcpyW
DeleteFileW
lstrcatW
GetWindowsDirectoryW
Sleep
GetFileAttributesW
CreateMutexW
GetCurrentProcess
FreeResource
LockResource
LoadResource
RtlCaptureContext
GetEnvironmentVariableW
GetVersion
lstrcmpW
GetLocaleInfoW
GetLastError
CloseHandle
HeapFree
HeapAlloc
GetProcessHeap
OpenProcess
FreeLibrary
FindResourceExW

user32

DialogBoxParamW
ExitWindowsEx
CharNextW
PostMessageW
SetWindowTextW
ShowWindow
EndDialog
LoadStringW
MessageBoxW
SetDlgItemTextW
GetDlgItem
EnableWindow
GetWindowThreadProcessId
FindWindowW

setupapi

SetupDiCallClassInstaller
SetupDiSetDeviceRegistryPropertyW
SetupDiCreateDeviceInfoW
SetupDiCreateDeviceInfoList
SetupDiGetINFClassW
SetupDiGetDeviceInstallParamsW
SetupDiSetClassInstallParamsW
CM_Get_Device_ID_ExW
SetupDiGetDeviceInfoListDetailW
SetupDiGetDeviceRegistryPropertyW
SetupDiEnumDeviceInfo
SetupDiOpenDeviceInfoW
SetupDiGetClassDevsExW
SetupDiCreateDeviceInfoListExW
SetupDiClassGuidsFromNameExW
CM_Get_DevNode_Status_Ex
SetupDiDestroyDeviceInfoList

shlwapi

PathFileExistsW

Sections

.text
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 552B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

10afc90e59035551b6de2784fb57150c

Code Sign

18:23:2a:ce:52:10:a6:b0:4d:86:17:a5:00:40:af:4cCertificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

53:7e:f3:53:d1:2b:07:77:43:4b:a0:76:35:33:2f:77:2e:fd:89:c6Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

advapi32

kernel32

user32

setupapi

shlwapi

Sections

.text Size: 20KB - Virtual size: 19KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 1024B - Virtual size: 552B

.rsrc Size: 6KB - Virtual size: 5KB

18:23:2a:ce:52:10:a6:b0:4d:86:17:a5:00:40:af:4c
Certificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

53:7e:f3:53:d1:2b:07:77:43:4b:a0:76:35:33:2f:77:2e:fd:89:c6
Signer

.text
Size: 20KB - Virtual size: 19KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 1024B - Virtual size: 552B

.rsrc
Size: 6KB - Virtual size: 5KB