eb9dde4482f3662aeb1795bb0eb08608_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

eb9dde4482f3662aeb1795bb0eb08608_JaffaCakes118
Size

197KB
MD5

eb9dde4482f3662aeb1795bb0eb08608
SHA1

117120cef5e2d6ea4708d57015b2c536e9c6a6ed
SHA256

2993a24799e4a7d9e1494ff3eb0598fa42f8398711e8cbac08a7399f5cf1f800
SHA512

e62c74fe8dfa9ffc2b1e6763fca01d0c23d5cb0bea6c77d77b75b1c5adcbe0912cda70331500f18c260335c7d72c8688cd6db2d2e834c9eb247a958234818ca9
SSDEEP

1536:R8IEfS0kN1aexFEgY8jHhbQRfwBfO/Zl4thddkaW/7qCFrgf7vr+ESOkiT:J+IjHhbQRfws/ydjufpgf7T+tO7

Score

1^/10

Malware Config

Signatures

Files

eb9dde4482f3662aeb1795bb0eb08608_JaffaCakes118
.exe windows:5 windows x86 arch:x86

d57fd27bb594bd0cdf4d94ea07822435

Code Sign

fe:67:e4:f1:5a:24:e3:c6:0d:54:7c:a0:20:c2:76:70
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

08/03/2016, 13:10

Not After

30/05/2027, 13:10

Subject

CN=Certum EV TSA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

ae:b6:01:ef:c3:f0:4a:41:d6:1f:0f:92:73:27:2d:7d
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

14/08/2018, 00:00

Not After

14/08/2019, 23:59

Subject

CN=ZK9 LTD,O=ZK9 LTD,POSTALCODE=E7 0AL,STREET=7 Broxbourne Road,L=London,ST=London,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

83:da:87:2c:bf:a3:9e:b1:bf:30:7e:24:0d:ba:43:ab:63:5e:81:9f
Signer

Actual PE Digest

83:da:87:2c:bf:a3:9e:b1:bf:30:7e:24:0d:ba:43:ab:63:5e:81:9f

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

bENHWRJNRw@#GHNe.pdb

Imports

kernel32

CompareStringA
GetPrivateProfileSectionNamesA
TzSpecificLocalTimeToSystemTime
FindFirstFileExW
LocaleNameToLCID
SetCurrentConsoleFontEx
EnumSystemCodePagesW

rpcrt4

I_RpcFreeBuffer

shlwapi

StrChrNW
PathIsUNCA

user32

OffsetRect
SetUserObjectInformationW

ntdsapi

DsListSitesW

ntdll

isdigit

oleaut32

CreateTypeLib2
SafeArrayDestroyDescriptor

advapi32

RegQueryInfoKeyA
CryptDeriveKey
AdjustTokenGroups
RegSetKeySecurity

msi

ord30

setupapi

SetupDiOpenDeviceInfoW
SetupDiSetSelectedDevice

winmm

midiOutCacheDrumPatches

Sections

.text
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.crt0
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.crt0
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

znfu
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

0s4
Size: 36KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

CONST
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.qdata
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 352B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d57fd27bb594bd0cdf4d94ea07822435

Code Sign

fe:67:e4:f1:5a:24:e3:c6:0d:54:7c:a0:20:c2:76:70Certificate

Extended Key Usages

Key Usages

ae:b6:01:ef:c3:f0:4a:41:d6:1f:0f:92:73:27:2d:7dCertificate

Extended Key Usages

Key Usages

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate

Extended Key Usages

Key Usages

83:da:87:2c:bf:a3:9e:b1:bf:30:7e:24:0d:ba:43:ab:63:5e:81:9fSigner

Headers

File Characteristics

PDB Paths

Imports

kernel32

rpcrt4

shlwapi

user32

ntdsapi

ntdll

oleaut32

advapi32

msi

setupapi

winmm

Sections

.text Size: 20KB - Virtual size: 19KB

.data Size: 4KB - Virtual size: 10KB

.crt0 Size: 28KB - Virtual size: 24KB

.crt0 Size: 28KB - Virtual size: 24KB

znfu Size: 16KB - Virtual size: 12KB

0s4 Size: 36KB - Virtual size: 32KB

CONST Size: 12KB - Virtual size: 10KB

.qdata Size: 36KB - Virtual size: 33KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 352B

fe:67:e4:f1:5a:24:e3:c6:0d:54:7c:a0:20:c2:76:70
Certificate

ae:b6:01:ef:c3:f0:4a:41:d6:1f:0f:92:73:27:2d:7d
Certificate

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

83:da:87:2c:bf:a3:9e:b1:bf:30:7e:24:0d:ba:43:ab:63:5e:81:9f
Signer

.text
Size: 20KB - Virtual size: 19KB

.data
Size: 4KB - Virtual size: 10KB

.crt0
Size: 28KB - Virtual size: 24KB

.crt0
Size: 28KB - Virtual size: 24KB

znfu
Size: 16KB - Virtual size: 12KB

0s4
Size: 36KB - Virtual size: 32KB

CONST
Size: 12KB - Virtual size: 10KB

.qdata
Size: 36KB - Virtual size: 33KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 352B