df6045797e353a494a1b21e628947495_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

df6045797e353a494a1b21e628947495_JaffaCakes118
Size

215KB
MD5

df6045797e353a494a1b21e628947495
SHA1

ea87a5ede9b263530d954e75eb52437515e423b7
SHA256

50d0f6410e144261204f86426ca4f5b4459354979215878ed99522cf57a1ec06
SHA512

da6b3ec367818732f449123474e3e6dc04fe693eb100b906655a6d1686bebf71f37936d7caf5dd6684422c20cab7866fa3d65decd17f2345d955e1a2a2f35495
SSDEEP

6144:Z4dwX2DKMu7ZKpqinZGWQtanWcwSsqOWfM9L0p:Z+wmMNK8icWdn+t9L2

Score

1^/10

Malware Config

Signatures

Files

df6045797e353a494a1b21e628947495_JaffaCakes118
.dll windows:4 windows x86 arch:x86

06efa37e9e5f52b5986a92b33287dae1

Code Sign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16-07-2004 00:00

Not After

15-07-2014 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

79:e2:99:00:6f:7a:e2:5e:06:2b:1a:7a:06:7f:c5:48
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

05-04-2006 00:00

Not After

13-04-2009 23:59

Subject

CN=CyberLink,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=CyberLink,L=Taipei,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

a9:da:e9:49:51:b3:ba:95:3a:17:31:a2:eb:d7:6c:08:96:be:53:70
Signer

Actual PE Digest

a9:da:e9:49:51:b3:ba:95:3a:17:31:a2:eb:d7:6c:08:96:be:53:70

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\Work\MpgVEnc6.4\MpgVEnc\cMPG2V\Release_SSE4\CLMP2Vs4.pdb

Imports

winmm

timeGetTime

msvcr80

_lock
__dllonexit
_unlock
__clean_type_info_names_internal
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
_crt_debugger_hook
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
free
_encoded_null
_malloc_crt
_encode_pointer
?terminate@@YAXXZ
_ftol
_except_handler3
sprintf
strstr
_purecall
fprintf
fclose
fopen_s
??_U@YAPAXI@Z
??_V@YAXPAX@Z
__CxxFrameHandler
??3@YAXPAX@Z
??2@YAPAXI@Z
_aligned_malloc
_aligned_free
_onexit
memset
memcpy

kernel32

GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InterlockedCompareExchange
InterlockedExchange
GetCurrentThread
GetThreadPriority
SetThreadPriority
QueryPerformanceFrequency
QueryPerformanceCounter
GetCurrentProcess
GetProcessAffinityMask
SetProcessAffinityMask
GetSystemInfo
GetTickCount
InitializeCriticalSection
CreateEventA
CloseHandle
LoadLibraryA
GetTempPathA
GetTempFileNameA
CopyFileA
GetProcAddress
Sleep
VirtualFree
VirtualAlloc
GetModuleFileNameA
DeleteFileA
FreeLibrary
DeleteCriticalSection

user32

wsprintfA

advapi32

RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey

pthreadvc2

pthread_attr_destroy
pthread_join
pthread_create
pthread_attr_setdetachstate
pthread_mutex_destroy
pthread_mutex_init
pthread_cond_wait
pthread_mutex_unlock
pthread_cond_destroy
pthread_mutex_lock
pthread_attr_init
pthread_cond_signal

Exports

Exports

CreateCLMPEG2Encoder
CreateMSMTenc
MT_EncodeMSMT
ReleaseMSMTenc

Sections

.text
Size: 156KB - Virtual size: 155KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text1
Size: 4KB - Virtual size: 472B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data1
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

06efa37e9e5f52b5986a92b33287dae1

Code Sign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

79:e2:99:00:6f:7a:e2:5e:06:2b:1a:7a:06:7f:c5:48Certificate

Extended Key Usages

Key Usages

a9:da:e9:49:51:b3:ba:95:3a:17:31:a2:eb:d7:6c:08:96:be:53:70Signer

Headers

File Characteristics

PDB Paths

Imports

winmm

msvcr80

kernel32

user32

advapi32

pthreadvc2

Exports

Exports

Sections

.text Size: 156KB - Virtual size: 155KB

.text1 Size: 4KB - Virtual size: 472B

.rdata Size: 12KB - Virtual size: 10KB

.data Size: 16KB - Virtual size: 31KB

.data1 Size: 4KB - Virtual size: 1KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 12KB - Virtual size: 8KB

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

79:e2:99:00:6f:7a:e2:5e:06:2b:1a:7a:06:7f:c5:48
Certificate

a9:da:e9:49:51:b3:ba:95:3a:17:31:a2:eb:d7:6c:08:96:be:53:70
Signer

.text
Size: 156KB - Virtual size: 155KB

.text1
Size: 4KB - Virtual size: 472B

.rdata
Size: 12KB - Virtual size: 10KB

.data
Size: 16KB - Virtual size: 31KB

.data1
Size: 4KB - Virtual size: 1KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 12KB - Virtual size: 8KB