e20af05aceeb92a2d8a5ad8586299fa0_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

e20af05aceeb92a2d8a5ad8586299fa0_JaffaCakes118
Size

304KB
MD5

e20af05aceeb92a2d8a5ad8586299fa0
SHA1

7a2bce8260f4819daeb1a555d56228b7a65511da
SHA256

b0bb70f23c3ccfc128d7932903c82c6d77debc8dfd306f1cf69ecd2829dac353
SHA512

6c0f334ff1bd0a1a5617ba81d2c82ac6eed4d5bd925fc2d76f361f30de530ee7fc99ead14d05e79d21cfa12677cddbfe2562e5846dddf45b983d96a4e87b4a66
SSDEEP

6144:FXQU+xdNzhSz2m6waiXlSIYSq2OYeQm19xOqXsPYEO:CU+82eF1SHd2OGM9x/3/

Score

1^/10

Malware Config

Signatures

Files

e20af05aceeb92a2d8a5ad8586299fa0_JaffaCakes118
.exe windows:4 windows x86 arch:x86

d27ab98e108d8d2321141c8c69d20cee

Code Sign

47:27:7a:6e:c5:07:ba:73:bc:4c:bf:d7:51:b1:c6:86
Certificate

Issuer

CN=55666123h

Not Before

14/02/2012, 20:22

Not After

31/12/2039, 23:59

Subject

CN=55666123h

Extended Key Usages

ExtKeyUsageCodeSigning

9a:dd:48:7f:f6:11:29:3b:a4:14:98:5c:d7:43:e6:f7:b1:9f:d3:d0
Signer

Actual PE Digest

9a:dd:48:7f:f6:11:29:3b:a4:14:98:5c:d7:43:e6:f7:b1:9f:d3:d0

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetWindowsDirectoryW
lstrlenW
lstrcpyW
CreateFileW
VirtualAlloc
LockResource
GetLogicalDriveStringsW
QueueUserWorkItem
SetFileAttributesW
GetTempPathW
GetWindowsDirectoryA
UnregisterWait
ChangeTimerQueueTimer
_hwrite
CreateEventW
OpenWaitableTimerW
VirtualFreeEx
FlushConsoleInputBuffer
CloseHandle
CreateFileMappingW
SetConsoleActiveScreenBuffer
GetProcessAffinityMask
GetSystemDirectoryA
FindAtomA
GetConsoleCursorInfo
TransmitCommChar
GetCurrencyFormatW
GetCurrentThread
GetFileAttributesA
Module32NextW
MapViewOfFile
SetCurrentDirectoryW
GetPrivateProfileStringW
GetConsoleAliasW
ReadFile
OpenEventA
LocalShrink
SetStdHandle
ClearCommBreak
UnlockFile
GetTickCount
WinExec
FindResourceExW
VerifyVersionInfoW
GetMailslotInfo
GetComputerNameA
GetSystemInfo
CreateDirectoryExA
CreateJobObjectA
GetSystemWindowsDirectoryA
SetMailslotInfo
FindAtomW
GetDriveTypeW
SetPriorityClass
SetHandleCount
OpenMutexW
WriteProfileSectionA
ReplaceFileA
CopyFileExA
SetConsoleScreenBufferSize
_llseek
EnumSystemCodePagesA
ExpandEnvironmentStringsW
CopyFileA
GetCalendarInfoW
ContinueDebugEvent
ReadConsoleInputW
TlsFree
CreateRemoteThread
GetBinaryTypeA
ReadConsoleOutputA
SetTapePosition
Process32NextW
Module32FirstW
LocalLock
LocalAlloc
GetStringTypeW
HeapCreate
GetStdHandle
AddAtomA
ReleaseMutex
PrepareTape
FindCloseChangeNotification
PulseEvent
SetSystemTimeAdjustment
SetFilePointer
HeapUnlock
EnumResourceTypesW
GlobalUnlock
VerifyVersionInfoA
PeekNamedPipe
FindNextFileW
FlushViewOfFile
AddAtomW
GetTempFileNameA
InitializeCriticalSectionAndSpinCount
SetErrorMode
WritePrivateProfileSectionW
GetSystemDefaultUILanguage
CreateTimerQueueTimer
UpdateResourceW
DisconnectNamedPipe
OutputDebugStringA
HeapCompact
ExitProcess
Module32Next
GetCurrentThreadId
GetConsoleWindow
WriteFileEx
EnumSystemLanguageGroupsW
LoadLibraryW
FindFirstVolumeA
HeapSize
ReleaseSemaphore
lstrcpyn
FindFirstVolumeW
CancelTimerQueueTimer
MoveFileWithProgressW
FindFirstChangeNotificationA
DefineDosDeviceW
SetThreadLocale
FindVolumeClose
lstrlenA
GetModuleFileNameW
EnumCalendarInfoExA
SetConsoleCursorInfo
GetConsoleAliasExesLengthA
EnumDateFormatsExW
GetComputerNameExW
lstrcatA
DeleteFiber
CancelDeviceWakeupRequest
InterlockedDecrement
SetCommBreak
GetDiskFreeSpaceA
CreateMutexW
EnumSystemLocalesA
GetSystemDefaultLangID
FillConsoleOutputAttribute
GetCommTimeouts

advapi32

RegOpenKeyExW

ole32

OleSetAutoConvert
MonikerCommonPrefixWith
StgConvertVariantToProperty
CoBuildVersion
CoUnmarshalHresult
OleGetAutoConvert
CoGetCallContext
UtConvertDvtd32toDvtd16
CreateDataCache
HGLOBAL_UserUnmarshal
CoRegisterMessageFilter
HMETAFILEPICT_UserFree
CoCreateInstanceEx
CLIPFORMAT_UserFree
StgOpenPropStg
CreateOleAdviseHolder
CreatePointerMoniker
HMETAFILE_UserFree
CoResumeClassObjects
WriteOleStg
OleCreateMenuDescriptor
StgIsStorageFile
WriteClassStg
CLSIDFromString
SNB_UserFree
STGMEDIUM_UserUnmarshal
StgCreatePropStg
GetHookInterface
StgCreateStorageEx
FmtIdToPropStgName
DcomChannelSetHResult
OleCreateFromFile
UtGetDvtd16Info
CoQueryReleaseObject
StgOpenAsyncDocfileOnIFillLockBytes
CoAddRefServerProcess
OleRegEnumFormatEtc
HWND_UserSize
HICON_UserMarshal
OleSaveToStream
HBRUSH_UserSize
OleCreateLinkFromDataEx
CoSetProxyBlanket
HPALETTE_UserSize
OleInitialize
OleConvertIStorageToOLESTREAMEx
CoGetObjectContext
HBITMAP_UserSize
MonikerRelativePathTo
CreateStdProgressIndicator
OleCreateFromData
OleGetClipboard
OleQueryCreateFromData
OleDestroyMenuDescriptor
StgCreateDocfileOnILockBytes
CoCreateFreeThreadedMarshaler
CoRevertToSelf
CoDisconnectObject
DoDragDrop
FreePropVariantArray
HkOleRegisterObject
CoRegisterPSClsid
HMETAFILE_UserSize
OleFlushClipboard
CoGetApartmentID
CoUnloadingWOW
GetRunningObjectTable
OleUninitialize
StringFromGUID2
STGMEDIUM_UserSize
CoMarshalHresult
PropVariantClear
OleCreateStaticFromData
SNB_UserUnmarshal
PropStgNameToFmtId
HMETAFILEPICT_UserSize
CoCreateInstance
HENHMETAFILE_UserFree
HENHMETAFILE_UserUnmarshal
HMETAFILEPICT_UserUnmarshal
HMENU_UserUnmarshal
CreateGenericComposite
SetDocumentBitStg
OleConvertOLESTREAMToIStorageEx
DllDebugObjectRPCHook
WdtpInterfacePointer_UserMarshal
OleBuildVersion
StgSetTimes
CoGetCallerTID
CoTestCancel
HMENU_UserMarshal
CoSuspendClassObjects
HACCEL_UserMarshal
CoGetCurrentProcess
CoGetStdMarshalEx
HWND_UserMarshal
HGLOBAL_UserFree
CLIPFORMAT_UserUnmarshal
OleDoAutoConvert
HPALETTE_UserUnmarshal
OleCreateDefaultHandler
OleRegEnumVerbs
OleSetMenuDescriptor
CoGetInstanceFromFile
ReadClassStg
StringFromIID
CoRevokeMallocSpy
OleCreateLink
CoDeactivateObject
CoImpersonateClient
HBRUSH_UserFree
CoCancelCall
OleCreate
CoGetCurrentLogicalThreadId
HMENU_UserFree
CreateILockBytesOnHGlobal

comctl32

ImageList_LoadImage
InitializeFlatSB
CreatePropertySheetPageW
ImageList_Read
ImageList_DrawEx
ImageList_GetDragImage
ord2
PropertySheetA
DrawStatusText
ImageList_GetBkColor
InitMUILanguage
ord13
DestroyPropertySheetPage
FlatSB_GetScrollProp
ImageList_AddMasked
ImageList_SetDragCursorImage
ImageList_DragEnter
ImageList_GetImageCount
ImageList_SetFilter
InitCommonControlsEx
ImageList_GetImageRect
ImageList_Remove
GetMUILanguage
PropertySheet
FlatSB_GetScrollRange
CreatePropertySheetPage
ImageList_SetImageCount
CreateStatusWindow
FlatSB_EnableScrollBar
FlatSB_SetScrollProp
DrawStatusTextW
ImageList_LoadImageA
ImageList_GetImageInfo
FlatSB_SetScrollRange
ImageList_Draw
FlatSB_SetScrollPos
ImageList_DragShowNolock
ord6
ImageList_GetIconSize
ord16
ImageList_Merge
ord4
ImageList_EndDrag
ord14
ImageList_Replace
CreateToolbarEx
ImageList_BeginDrag
ord17
ord5
ImageList_Destroy
ImageList_Copy
ImageList_Write
ImageList_Duplicate
ord3
ImageList_Add
ord15
FlatSB_SetScrollInfo
FlatSB_GetScrollInfo
CreatePropertySheetPageA
FlatSB_ShowScrollBar
ImageList_AddIcon
ImageList_LoadImageW
ImageList_DrawIndirect
PropertySheetW
ImageList_ReplaceIcon
_TrackMouseEvent
CreateStatusWindowW
UninitializeFlatSB
ImageList_Create
ImageList_DragLeave
ImageList_GetIcon
ord7
ImageList_SetIconSize

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.textV2
Size: 278KB - Virtual size: 278KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.textF4
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.textV3
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.textV4
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.textV1
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d27ab98e108d8d2321141c8c69d20cee

Code Sign

47:27:7a:6e:c5:07:ba:73:bc:4c:bf:d7:51:b1:c6:86Certificate

Extended Key Usages

9a:dd:48:7f:f6:11:29:3b:a4:14:98:5c:d7:43:e6:f7:b1:9f:d3:d0Signer

Headers

File Characteristics

Imports

kernel32

advapi32

ole32

comctl32

Sections

.text Size: 4KB - Virtual size: 4KB

.textV2 Size: 278KB - Virtual size: 278KB

.textF4 Size: 2KB - Virtual size: 2KB

.textV3 Size: 512B - Virtual size: 500B

.textV4 Size: 512B - Virtual size: 500B

.textV1 Size: 512B - Virtual size: 500B

.data Size: 9KB - Virtual size: 9KB

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 2KB - Virtual size: 1KB

47:27:7a:6e:c5:07:ba:73:bc:4c:bf:d7:51:b1:c6:86
Certificate

9a:dd:48:7f:f6:11:29:3b:a4:14:98:5c:d7:43:e6:f7:b1:9f:d3:d0
Signer

.text
Size: 4KB - Virtual size: 4KB

.textV2
Size: 278KB - Virtual size: 278KB

.textF4
Size: 2KB - Virtual size: 2KB

.textV3
Size: 512B - Virtual size: 500B

.textV4
Size: 512B - Virtual size: 500B

.textV1
Size: 512B - Virtual size: 500B

.data
Size: 9KB - Virtual size: 9KB

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 2KB - Virtual size: 1KB