e274373462a97741a42740c3befa0ddd_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

e274373462a97741a42740c3befa0ddd_JaffaCakes118
Size

50KB
MD5

e274373462a97741a42740c3befa0ddd
SHA1

f7e8c86127f46e6962f3d51c7fdc93d8398a1815
SHA256

363009234aa9e0cd0f4b2158014b6af485c0a9f7a4b773b92a24ef7dad0d8638
SHA512

ef6447c9ae623de93aa7a13201e64773fd2c419c8d1c02bf5a135180b2bf730bf72cbbbec54aab2ff7b36909580f0348348ee20d2100b07f8602919e39c0567e
SSDEEP

1536:l3cp61IlpTxtQWtbXrxAxWq3nwA+GHrfX8gz0u:mpYalx3nsnH+GHrfX8gz0u

Score

1^/10

Malware Config

Signatures

Files

e274373462a97741a42740c3befa0ddd_JaffaCakes118
.dll windows:6 windows x86 arch:x86

3db96d82ebae778f4b3714af73d057eb

Code Sign

06:59:13:bf:67:e5:b8:1f:e1:e8:a8:31:67:ee:fb:fc
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

16/12/2016, 00:00

Not After

14/02/2020, 23:59

Subject

CN=BEIJING KUWO TECHNOLOGY CO.\,LTD.,OU=Desktop Product Division,O=BEIJING KUWO TECHNOLOGY CO.\,LTD.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

19/02/2018, 00:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign TSA for Advanced - G2

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02/08/2011, 10:00

Not After

29/03/2029, 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

c0:f7:06:f6:f6:a4:45:9c:4a:e5:c5:de:23:17:a9:21:96:7d:4d:f8:6b:f2:12:33:27:a6:07:e2:ac:53:99:e4
Signer

Actual PE Digest

c0:f7:06:f6:f6:a4:45:9c:4a:e5:c5:de:23:17:a9:21:96:7d:4d:f8:6b:f2:12:33:27:a6:07:e2:ac:53:99:e4

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\workspace\Projects\MIR\Release\AudFprint.pdb

Imports

msvcp120

?_Xlength_error@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ

msvcr120

??0exception@std@@QAE@ABV01@@Z
_purecall
??1type_info@@UAE@XZ
__CppXcptFilter
_amsg_exit
free
_malloc_crt
_initterm
??0exception@std@@QAE@ABQBD@Z
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
?terminate@@YAXXZ
_lock
_unlock
_calloc_crt
__dllonexit
_onexit
__clean_type_info_names_internal
_except_handler4_common
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??2@YAPAXI@Z
??3@YAXPAX@Z
??_V@YAXPAX@Z
memmove
_initterm_e
_CxxThrowException
__CxxFrameHandler3
_libm_sse2_cos_precise
_libm_sse2_sin_precise
memcpy
memset

kernel32

DecodePointer
IsDebuggerPresent
IsProcessorFeaturePresent
QueryPerformanceCounter
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
EncodePointer

Exports

Exports

ComputeAFprints
CreateAFprinter
DestroyAFprinter
InitAFprinter

Sections

.text
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3db96d82ebae778f4b3714af73d057eb

Code Sign

06:59:13:bf:67:e5:b8:1f:e1:e8:a8:31:67:ee:fb:fcCertificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3aCertificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:31:89:c6:50:04Certificate

Key Usages

c0:f7:06:f6:f6:a4:45:9c:4a:e5:c5:de:23:17:a9:21:96:7d:4d:f8:6b:f2:12:33:27:a6:07:e2:ac:53:99:e4Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcp120

msvcr120

kernel32

Exports

Exports

Sections

.text Size: 34KB - Virtual size: 33KB

.rdata Size: 5KB - Virtual size: 5KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 1KB

06:59:13:bf:67:e5:b8:1f:e1:e8:a8:31:67:ee:fb:fc
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a
Certificate

04:00:00:00:00:01:31:89:c6:50:04
Certificate

c0:f7:06:f6:f6:a4:45:9c:4a:e5:c5:de:23:17:a9:21:96:7d:4d:f8:6b:f2:12:33:27:a6:07:e2:ac:53:99:e4
Signer

.text
Size: 34KB - Virtual size: 33KB

.rdata
Size: 5KB - Virtual size: 5KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 1KB