ea21b50d6cca02e94f3543a8a2c382d2_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

ea21b50d6cca02e94f3543a8a2c382d2_JaffaCakes118
Size

1.2MB
MD5

ea21b50d6cca02e94f3543a8a2c382d2
SHA1

5b09e389ed1e2de4e8fc96e1e28b835c8e56836d
SHA256

05433960753095ded7b8625ee0afd8c3140d6692a3dbe54c392143985bc6d288
SHA512

217a4e8e49e1a49858f864883ef597d1d3faa99d7f43ea8eed4fc6378614387747032cc76e4a66c32d73c508da7047af6f46b1d39b6643ada5ac575f2fc81f1e
SSDEEP

24576:Sxp2ps3spTFZsVOuH0El3tOSgfzWsnqGff:8+LTFZUHbl3CT

Score

1^/10

Malware Config

Signatures

Files

ea21b50d6cca02e94f3543a8a2c382d2_JaffaCakes118
.exe windows:5 windows x86 arch:x86

9e0c30bb2dcbd17c98b0fe0659f6c59a

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

04/03/2014, 00:00

Not After

03/03/2024, 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

12:34:40:59:ba:77:e5:f3:17:3d:11:1f:e9:65:80:1a
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

17/05/2019, 00:00

Not After

16/05/2020, 23:59

Subject

SERIALNUMBER=11391955,CN=Garvin Haslett Ltd,O=Garvin Haslett Ltd,L=Southampton,ST=Hampshire,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#130b536f757468616d70746f6e,1.3.6.1.4.1.311.60.2.1.2=#130948616d707368697265,1.3.6.1.4.1.311.60.2.1.3=#13024742

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

04/03/2014, 00:00

Not After

03/03/2024, 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

12:34:40:59:ba:77:e5:f3:17:3d:11:1f:e9:65:80:1a
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

17/05/2019, 00:00

Not After

16/05/2020, 23:59

Subject

SERIALNUMBER=11391955,CN=Garvin Haslett Ltd,O=Garvin Haslett Ltd,L=Southampton,ST=Hampshire,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#130b536f757468616d70746f6e,1.3.6.1.4.1.311.60.2.1.2=#130948616d707368697265,1.3.6.1.4.1.311.60.2.1.3=#13024742

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:83:83:0c:ec:1d:48:86:c6:04:6d:84:9a:eb:0a:0b:32:92:65:7a:40:ac:05:8f:e0:b4:c8:1b:d6:64:e4:00
Signer

Actual PE Digest

47:83:83:0c:ec:1d:48:86:c6:04:6d:84:9a:eb:0a:0b:32:92:65:7a:40:ac:05:8f:e0:b4:c8:1b:d6:64:e4:00

Digest Algorithm

sha256

PE Digest Matches

true

bd:79:a1:88:27:53:86:90:32:c7:72:96:54:54:22:23:87:c5:fe:bf
Signer

Actual PE Digest

bd:79:a1:88:27:53:86:90:32:c7:72:96:54:54:22:23:87:c5:fe:bf

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateBoundaryDescriptorA
InterlockedExchange
DeleteFileA
WriteFile
VirtualAlloc
GetSystemTimeAsFileTime
CreateHardLinkTransactedA
HeapDestroy
InitializeCriticalSection
CreateToolhelp32Snapshot
RaiseException
GetTimeZoneInformation
GetNamedPipeHandleStateA
FreeLibrary
TerminateProcess
EnterCriticalSection
FlushFileBuffers
GetProcessHeap
OpenJobObjectW
GetCurrentProcessId
HeapCreate
Sleep
SizeofResource
CreateFileW
GetThreadIOPendingFlag
InterlockedDecrement
CloseHandle
GetStdHandle
DeleteCriticalSection
GlobalUnfix
AreFileApisANSI
SetFilePointer
GetFileSize
EnumSystemLocalesA
CreateFileA
VirtualFree
GetModuleHandleA
LCMapStringA
LeaveCriticalSection
GetTimeFormatA
CreateSemaphoreExW
GetFileAttributesTransactedW
GetCurrentThreadId
GetLocaleInfoW
GetCurrentProcess
RemoveDirectoryA
GetEnvironmentStringsW
GetProcAddress
FreeEnvironmentStringsA
RegisterApplicationRestart
GetNamedPipeClientComputerNameW
InitializeCriticalSectionAndSpinCount
CreateDirectoryA
IsValidLocale
HeapSize
ExitProcess
ReadConsoleW
SetUnhandledExceptionFilter
DeleteProcThreadAttributeList
LockResource
EnumCalendarInfoExW
LoadLibraryA
FreeEnvironmentStringsW
GetVersionExA
TlsSetValue
LoadResource
CopyFileExA
lstrlenA
FindResourceA
GetStartupInfoA
GetStringTypeW
DuplicateHandle
ReadConsoleOutputCharacterW
HeapFree
SetErrorMode
GetLocaleInfoA
TlsGetValue
GetLastError
SuspendThread
RtlUnwind
GetNumberFormatA
SetEndOfFile
GetConsoleCP
GetModuleFileNameW
GetConsoleOutputCP
GetOEMCP
SetStdHandle
CreateProcessW
InterlockedIncrement
TlsAlloc
MultiByteToWideChar
GetEnvironmentStrings
GetModuleHandleW
CompareStringW
IsDebuggerPresent
GetEnvironmentVariableA
GetCPInfo
OpenFile
GetCommandLineA
Process32First
LCMapStringW
FindResourceExA
GetTickCount
ReadFile
HeapAlloc
GetCurrentThread
GetConsoleMode
GetFileType
GetACP
CopyFileW
GetNumaAvailableMemoryNode
WriteConsoleW
FatalAppExitA
GetUserDefaultLCID
TlsFree
CreateThread
WriteConsoleA
SetHandleCount
HeapReAlloc
Process32Next
WideCharToMultiByte
CreateProcessA
GetDynamicTimeZoneInformation
GetStringTypeA
SetEnvironmentVariableA
GetDateFormatA
UnhandledExceptionFilter
GetModuleFileNameA
CompareStringA
GlobalFix
SetConsoleCtrlHandler
UnmapViewOfFile
ConvertThreadToFiber
CreateActCtxW
IsValidCodePage
SetLastError
CreateMutexA
QueryPerformanceCounter

user32

EnumWindows
SetDlgItemInt
SwitchToThisWindow
EnumPropsExA
MessageBoxA
SendMessageA
EndDialog
CascadeWindows
SetWindowPos
DeleteMenu
UnregisterHotKey
PostMessageA
RemovePropW
GetSystemMenu
LoadIconA
IsClipboardFormatAvailable
RealGetWindowClassW
GetDlgItem
ScrollDC
HideCaret
SendMessageW
GetScrollInfo
IsRectEmpty
FindWindowExA
CreateDialogParamA
DialogBoxParamA
EnableMenuItem

advapi32

PerfQueryInstance
PerfIncrementULongLongCounterValue
AbortSystemShutdownA
RegEnumValueA
SetPrivateObjectSecurity
OpenEncryptedFileRawW
RegOpenUserClassesRoot
RegCopyTreeW
LookupPrivilegeValueA
RegSaveKeyW
CheckTokenMembership
InitiateSystemShutdownW
RegCloseKey
RegQueryInfoKeyA
GetSecurityDescriptorSacl
DestroyPrivateObjectSecurity
AdjustTokenPrivileges
EncryptFileA
AccessCheckAndAuditAlarmW
FreeEncryptionCertificateHashList
FreeSid
RegOpenKeyExA
RegGetKeySecurity
InitiateSystemShutdownA
ConvertStringSidToSidA
AllocateAndInitializeSid
RegSaveKeyExA
OpenProcessToken
AccessCheckByTypeResultListAndAuditAlarmByHandleW
AccessCheckByTypeResultList

shell32

SHGetFolderPathA
ord193
ord191
SHGetKnownFolderPath
SHGetSpecialFolderPathA
SHAddToRecentDocs
SHCreateDirectoryExW
ord75

ole32

CoInitializeSecurity
CoInitializeEx
CoCreateInstance
CoTaskMemFree
CoUninitialize

oleaut32

VarI8FromUI2
OleCreatePropertyFrameIndirect
VarUI4FromUI1
SafeArrayAllocDescriptorEx
VarR4FromCy
VarUI4FromDec
VarDateFromDisp
VarUI4FromI4
VarUI8FromR8
VarInt
SysAllocString
SysFreeString

shlwapi

PathIsNetworkPathW
StrStrNW
PathCreateFromUrlAlloc
PathIsRootA
PathIsRootW
PathAppendA
AssocQueryKeyW
PathFileExistsA
PathSkipRootW
PathFindFileNameA
IntlStrEqWorkerW
UrlCanonicalizeA
PathAddBackslashA

wininet

HttpOpenRequestA
InternetConnectA

psapi

EnumProcessModules

wtsapi32

WTSShutdownSystem
WTSVirtualChannelPurgeOutput
WTSFreeMemory
WTSDisconnectSession
WTSUnRegisterSessionNotificationEx

Sections

.text
Size: 217KB - Virtual size: 216KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 947KB - Virtual size: 946KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9e0c30bb2dcbd17c98b0fe0659f6c59a

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49Certificate

Extended Key Usages

Key Usages

12:34:40:59:ba:77:e5:f3:17:3d:11:1f:e9:65:80:1aCertificate

Extended Key Usages

Key Usages

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49Certificate

Extended Key Usages

Key Usages

12:34:40:59:ba:77:e5:f3:17:3d:11:1f:e9:65:80:1aCertificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

47:83:83:0c:ec:1d:48:86:c6:04:6d:84:9a:eb:0a:0b:32:92:65:7a:40:ac:05:8f:e0:b4:c8:1b:d6:64:e4:00Signer

bd:79:a1:88:27:53:86:90:32:c7:72:96:54:54:22:23:87:c5:fe:bfSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

wininet

psapi

wtsapi32

Sections

.text Size: 217KB - Virtual size: 216KB

.rdata Size: 36KB - Virtual size: 36KB

.data Size: 6KB - Virtual size: 14KB

.rsrc Size: 947KB - Virtual size: 946KB

.reloc Size: 13KB - Virtual size: 13KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

12:34:40:59:ba:77:e5:f3:17:3d:11:1f:e9:65:80:1a
Certificate

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

12:34:40:59:ba:77:e5:f3:17:3d:11:1f:e9:65:80:1a
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

47:83:83:0c:ec:1d:48:86:c6:04:6d:84:9a:eb:0a:0b:32:92:65:7a:40:ac:05:8f:e0:b4:c8:1b:d6:64:e4:00
Signer

bd:79:a1:88:27:53:86:90:32:c7:72:96:54:54:22:23:87:c5:fe:bf
Signer

.text
Size: 217KB - Virtual size: 216KB

.rdata
Size: 36KB - Virtual size: 36KB

.data
Size: 6KB - Virtual size: 14KB

.rsrc
Size: 947KB - Virtual size: 946KB

.reloc
Size: 13KB - Virtual size: 13KB