dff048def2adb0e55a203e7ccb2b2fcc_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
dff048def2adb0e55a203e7ccb2b2fcc_JaffaCakes118
Size 192KB
Sample240914-lrwqdsxfln
SHA256 24569b321a930930f08f5a09a08232f1c41f025a82fe5a76adf4448f77a9de4d
MD5 dff048def2adb0e55a203e7ccb2b2fcc
SHA1 f168d1ac2083ae08490c6389b146f294c001b1b9
SHA512 d7deeef447b84b2409df2fd27bc89fcb237c0f1cc2f084dfb8a38cdc5df744f0d11c99df1d4a5fdd9d72e75912409db4e74d0a211a5759cc53ccdba57f9dda4e
SSDEEP 3072:ViAl8zzQJWAxm7nMfRqT+wFlk7nHQ809beUMCt01jLu:VyzQL8nMfoT++SjHQ80LMnZu
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

dff048def2adb0e55a203e7ccb2b2fcc_JaffaCakes118

.dll 192KB

dff048def2adb0e55a203e7ccb2b2fcc_JaffaCakes118

IMPHASH 38971f507e339dad5f06a4d979b58c4d
SHA256 24569b321a930930f08f5a09a08232f1c41f025a82fe5a76adf4448f77a9de4d
MD5 dff048def2adb0e55a203e7ccb2b2fcc
SHA1 f168d1ac2083ae08490c6389b146f294c001b1b9
SHA512 d7deeef447b84b2409df2fd27bc89fcb237c0f1cc2f084dfb8a38cdc5df744f0d11c99df1d4a5fdd9d72e75912409db4e74d0a211a5759cc53ccdba57f9dda4e
SSDEEP 3072:ViAl8zzQJWAxm7nMfRqT+wFlk7nHQ809beUMCt01jLu:VyzQL8nMfoT++SjHQ80LMnZu
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

6a:a4:a7:ad:a7:79:4a:43:4a:c3:1f:54:7b:57:2f:84:6f:9c:3d:cb

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=DoubleD Advertising Limited,O=DoubleD Advertising Limited,POSTALCODE=N/A,STREET=COMMITTEE RD SHATIN NT+STREET=PLAZA 138 SHATIN RURAL+STREET=15/F TOWER 1 GRAND CENTRAL,L=HONG KONG,ST=HONG KONG,C=HK

Chains

Mar 20, 2009

Minor OS version

Major OS version

Entry point

65564

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

x:\Projects\ProductwiseToolbar\Sources\VS_Projects\Setup Helper\Setup Helper\Release\bin\stbsh.pdb

kernel32

LoadLibraryW CreateProcessA WaitForSingleObject GetVersionExA OutputDebugStringA DebugBreak InterlockedIncrement InterlockedDecrement lstrlenA GetLocalTime Sleep SetEndOfFile CreateFileW CreateFileA GetLocaleInfoW SetStdHandle RaiseException EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection WideCharToMultiByte InterlockedCompareExchange InterlockedExchange MultiByteToWideChar RtlUnwind GetLastError HeapFree TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCurrentThreadId GetCommandLineA HeapAlloc GetProcessHeap HeapReAlloc LCMapStringA LCMapStringW GetCPInfo GetProcAddress GetModuleHandleA ExitProcess GetStringTypeA GetStringTypeW TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError HeapDestroy HeapCreate VirtualFree VirtualAlloc SetHandleCount GetStdHandle GetFileType GetStartupInfoA WriteFile GetConsoleCP GetConsoleMode FlushFileBuffers ReadFile SetFilePointer CloseHandle GetACP GetOEMCP IsValidCodePage HeapSize GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetLocaleInfoA GetUserDefaultLCID EnumSystemLocalesA IsValidLocale FreeLibrary LoadLibraryA WriteConsoleA GetConsoleOutputCP WriteConsoleW

user32

LoadStringA UnregisterClassA CharNextA wvsprintfA

advapi32

RegDeleteKeyA RegCreateKeyExA RegSetValueExA RegCloseKey RegOpenKeyExA RegQueryInfoKeyA RegEnumValueA RegDeleteValueA RegQueryValueExA

shell32

SHGetFolderPathA

urlmon

URLDownloadToFileA

Sharing

General

Malware Config

Signatures

File Explorer

dff048def2adb0e55a203e7ccb2b2fcc_JaffaCakes118

PE Signature issue

kernel32

user32

advapi32

shell32

urlmon

generic