e0bcb5fe5a282fdde9254ac0de2df5ee_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

e0bcb5fe5a282fdde9254ac0de2df5ee_JaffaCakes118
Size

117KB
MD5

e0bcb5fe5a282fdde9254ac0de2df5ee
SHA1

ca7964de47e19971b5eca4cb31c032ce8b86f757
SHA256

cbc6c25b7df7ff93c256e3039eed9d99de893fa997240809779f2629b3f3b1c1
SHA512

795d745bde842e19521b3ea59a1e3deaccdf770208b366230886a3d17f0e5229c705b7e107515091ce9025977cbbe330886055b18bf93e85dc1100854cf3fce2
SSDEEP

3072:LZDmqcxkGiVfXA4PHqKO6lVjsHIRU2urVMVTH2lOzKGjIy0:FDakGiVDZO6pu4EwKGEy0

Score

1^/10

Malware Config

Signatures

Files

e0bcb5fe5a282fdde9254ac0de2df5ee_JaffaCakes118
.exe windows:5 windows x86 arch:x86

d0bd0078bc201cd3054a3b03a40aea0d

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

66:66:05:52:d4:65:b3:1f:42:9f:75:27:ea:6a:93:bf
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

08/09/2010, 00:00

Not After

23/11/2013, 23:59

Subject

CN=Symantec Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Symantec Research Labs,O=Symantec Corporation,L=Santa Monica,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

d7:26:ac:3e:40:b0:4c:ac:ef:ea:f1:97:5e:0a:b2:d1:ad:11:76:b7
Signer

Actual PE Digest

d7:26:ac:3e:40:b0:4c:ac:ef:ea:f1:97:5e:0a:b2:d1:ad:11:76:b7

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\bld_area\NIS_Shared_Components_r18.6\Bin\BIN.IRU\MCUI32.pdb

Imports

kernel32

SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
GetCommandLineW
GetLastError
MultiByteToWideChar
SetErrorMode
Sleep
GetCurrentThreadId
InterlockedIncrement
InterlockedDecrement
lstrlenW
DeleteCriticalSection
RaiseException
FreeLibrary
GetProcAddress
GetModuleHandleW
lstrcmpiW
LeaveCriticalSection
EnterCriticalSection
LoadLibraryExW
GetModuleFileNameW
InitializeCriticalSection
GetFileSize
CloseHandle
ReadFile
CreateFileW
GetFileAttributesW
OutputDebugStringW
GetLocaleInfoW
GetCurrentProcessId
GetCurrentProcess
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
InterlockedCompareExchange
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
LoadLibraryA
InterlockedExchange
LocalAlloc

user32

DefWindowProcW
SwitchToThisWindow
GetSystemMetrics
FindWindowW
CharNextW
GetDesktopWindow

ole32

CoTaskMemFree
CoCreateInstance
IIDFromString
CoTaskMemAlloc
CoTaskMemRealloc

oleaut32

VarUI4FromStr

msvcr90

_invoke_watson
_controlfp_s
__CxxFrameHandler3
??3@YAXPAX@Z
memcpy_s
wcslen
memmove_s
_wtol
wcsstr
wcsnlen
vswprintf_s
??_V@YAXPAX@Z
free
_recalloc
wcscat_s
memset
??2@YAPAXI@Z
wcsncpy_s
malloc
_waccess
mbstowcs_s
_snwprintf_s
strcpy_s
_wcsnicmp
wcscpy_s
wcschr
memmove
iswxdigit
_stricmp
strcat_s
_splitpath_s
?terminate@@YAXXZ
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler4_common
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_CxxThrowException

Exports

Exports

??4_Init_locks@std@@QAEAAV01@ABV01@@Z

Sections

.text
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 51KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

XOR
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

d0bd0078bc201cd3054a3b03a40aea0d

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

66:66:05:52:d4:65:b3:1f:42:9f:75:27:ea:6a:93:bfCertificate

Extended Key Usages

Key Usages

d7:26:ac:3e:40:b0:4c:ac:ef:ea:f1:97:5e:0a:b2:d1:ad:11:76:b7Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

ole32

oleaut32

msvcr90

Exports

Exports

Sections

.text Size: 38KB - Virtual size: 38KB

.rdata Size: 12KB - Virtual size: 12KB

.data Size: 1024B - Virtual size: 2KB

.rsrc Size: 51KB - Virtual size: 50KB

.reloc Size: 5KB - Virtual size: 5KB

XOR Size: 2KB - Virtual size: 2KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

66:66:05:52:d4:65:b3:1f:42:9f:75:27:ea:6a:93:bf
Certificate

d7:26:ac:3e:40:b0:4c:ac:ef:ea:f1:97:5e:0a:b2:d1:ad:11:76:b7
Signer

.text
Size: 38KB - Virtual size: 38KB

.rdata
Size: 12KB - Virtual size: 12KB

.data
Size: 1024B - Virtual size: 2KB

.rsrc
Size: 51KB - Virtual size: 50KB

.reloc
Size: 5KB - Virtual size: 5KB

XOR
Size: 2KB - Virtual size: 2KB