ef2fc995637f28a47ec96592c17a373c_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

ef2fc995637f28a47ec96592c17a373c_JaffaCakes118
Size

306KB
MD5

ef2fc995637f28a47ec96592c17a373c
SHA1

17ab811ae39e0c271a22ad7fee727ecd9fce51d2
SHA256

f6885254828fe0d341adf12a93f090f2877ee7eb99a9e27408c8fdd5121d3ecb
SHA512

3dc20aed34ca590d9c515d3679eed9d87b5e30e5cbfd4604c5cc4ea868180dfc1766415301bc8705eb3de5b483dd19cb4d71589ec6b66bca35106ffa3b77e5db
SSDEEP

6144:lhtLAppKkUTtvh2VuL6g8+fGKVMc3+toJFihLt3A+l:tApUTVAuL6gvfG+dJFihLt3A+l

Score

1^/10

Malware Config

Signatures

Files

ef2fc995637f28a47ec96592c17a373c_JaffaCakes118
.exe windows:5 windows x86 arch:x86

3e1f9ea03a2ad48fa17163729fd60d85

Code Sign

7e:1a:90:8b:37:b5:c7:66:b7:9a:e8:f5:5a:15:24:f6
Certificate

Issuer

CN=VDLQBBWQ

Not Before

12-03-2019 22:23

Not After

31-12-2039 23:59

Subject

CN=VDLQBBWQ

Extended Key Usages

ExtKeyUsageCodeSigning

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31-12-2015 00:00

Not After

09-07-2019 18:40

Subject

CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6f:cc:ec:f6:c6:9f:01:86:eb:f2:19:a0:2d:92:a6:17:3a:f0:28:08:9a:3d:31:64:50:b3:8f:04:87:af:be:fb
Signer

Actual PE Digest

6f:cc:ec:f6:c6:9f:01:86:eb:f2:19:a0:2d:92:a6:17:3a:f0:28:08:9a:3d:31:64:50:b3:8f:04:87:af:be:fb

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

UnhandledExceptionFilter
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WriteConsoleW
WriteFile
_llseek
TlsSetValue
lstrcmpW
lstrcmpiW
lstrcpynW
lstrlenA
lstrlenW
TlsGetValue
TlsFree
TlsAlloc
TerminateProcess
SwitchToThread
SwitchToFiber
Sleep
SizeofResource
SetUnhandledExceptionFilter
SetTimeZoneInformation
SetThreadAffinityMask
SetStdHandle
SetProcessShutdownParameters
SetProcessPriorityBoost
SetNamedPipeHandleState
SetLastError
SetFilePointerEx
SetFilePointer
SetFileAttributesW
RtlUnwind
RemoveDirectoryW
ReleaseMutex
ReadConsoleOutputCharacterW
QueryPerformanceCounter
OutputDebugStringW
MultiByteToWideChar
Module32NextW
LocalFree
LoadLibraryW
LoadLibraryExW
LeaveCriticalSection
LCMapStringW
LCMapStringA
IsValidCodePage
IsProcessorFeaturePresent
IsDebuggerPresent
IsBadCodePtr
InterlockedIncrement
InterlockedDecrement
InitializeCriticalSectionAndSpinCount
HeapSize
GetModuleHandleA
HeapReAlloc
HeapFree
HeapAlloc
Heap32ListNext
GlobalAlloc
GetTimeZoneInformation
GetTickCount
GetSystemTimeAsFileTime
GetSystemTime
GetSystemDirectoryW
GetStringTypeW
GetStdHandle
GetStartupInfoW
GetProcessHeap
GetProcAddress
GetOEMCP
GetModuleHandleW
GetModuleHandleExW
GetModuleFileNameW
GetMailslotInfo
GetLocalTime
GetLastError
GetFileType
GetEnvironmentStringsW
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
GetConsoleTitleW
GetConsoleScreenBufferInfo
GetConsoleOutputCP
GetConsoleMode
GetConsoleCP
GetCommandLineW
GetCalendarInfoW
GetCPInfo
GetAtomNameW
GetACP
FreeEnvironmentStringsW
FormatMessageW
FlushFileBuffers
ExitProcess
EnterCriticalSection
EncodePointer
DeleteCriticalSection
DecodePointer
CreateThread
CreateProcessA
CreateMutexW
CreateFileW
CopyFileW
CloseHandle
BuildCommDCBAndTimeoutsW
VirtualAlloc
lstrcatW

user32

PostQuitMessage
PostMessageW
MessageBoxW
LoadStringW
LoadIconW
LoadIconA
LoadAcceleratorsW
RegisterClassW
IsDlgButtonChecked
IsChild
IMPQueryIMEW
GetWindowThreadProcessId
RegisterWindowMessageW
SendDlgItemMessageA
SendDlgItemMessageW
SendMessageW
SetClassLongA
SetClassLongW
SetCursor
SetDlgItemTextW
SetFocus
SetForegroundWindow
SetShellWindow
SetWindowLongW
SetWindowPos
SetWindowTextW
TranslateAcceleratorW
UnregisterClassA
ReleaseCapture
IsCharAlphaNumericW
CreateMenu
WindowFromPoint
mouse_event
wsprintfW
KillTimer
GetWindowLongW
GetUserObjectInformationW
GetUpdateRect
GetSystemMetrics
GetProcessWindowStation
GetMenuStringA
GetMenuItemInfoW
GetGUIThreadInfo
GetForegroundWindow
GetDoubleClickTime
GetDlgItem
GetActiveWindow
FindWindowW
EnumDisplayMonitors
EndDialog
EnableWindow
DialogBoxParamW
DestroyMenu
DdeGetLastError
CreateWindowStationW
CreateWindowExW
CopyImage
ChildWindowFromPointEx
ChildWindowFromPoint
CharNextW
CascadeChildWindows
GetFocus
OpenIcon
IsMenu
DestroyWindow
WindowFromDC
CloseWindowStation
GetListBoxInfo
CloseDesktop
CloseWindow
IsDialogMessageA

gdi32

bInitSystemAndFontsDirectoriesW
XLATEOBJ_piVector
UpdateICMRegKeyW
StretchDIBits
SetTextColor
SetTextAlign
SetPixel
SetLayout
SetGraphicsMode
SetColorSpace
SetBkColor
SetBitmapBits
SetAbortProc
SelectObject
STROBJ_dwGetCodePage
ResetDCA
RectVisible
PolyTextOutA
CreatePatternBrush
GetObjectType
BeginPath
CreateDCW
EngDeletePalette
EnumICMProfilesW
EnumObjects
ExtTextOutW
GdiConvertBitmapV5
GdiEntry4
GdiEntry6
GdiFixUpHandle
GdiRealizationInfo
GdiSetPixelFormat
GdiStartDocEMF
GdiSwapBuffers
GetClipRgn
GetGlyphIndicesW
GetRegionData
GetTextAlign
GetTextCharacterExtra
GetTextExtentPoint32W
GetTextFaceW
PolyPolyline

advapi32

EqualSid
FreeSid
AllocateAndInitializeSid
RegOpenKeyA
RegQueryValueExW
OpenProcessToken
OpenThreadToken
RegCloseKey
RegCreateKeyExA
RegOpenKeyExW
RegSetValueExA
RegSetValueExW
GetTokenInformation

shell32

CheckEscapesW
ShellExecuteExW
SHGetSpecialFolderPathW
SHGetSettings
DoEnvironmentSubstA
FindExecutableW
SHBindToParent
SHCreateDirectoryExW
SHFileOperationA
SHFormatDrive
SHFreeNameMappings
SHGetDataFromIDListW
SHGetFolderLocation
SHGetFolderPathW
SHGetInstanceExplorer
ShellExecuteW

ole32

OleInitialize
OleUninitialize

shlwapi

StrChrW
StrChrIW
StrChrA

comctl32

ImageList_GetIconSize
ImageList_GetIcon
ImageList_GetDragImage
ImageList_GetBkColor
ImageList_EndDrag
ImageList_DrawEx
ImageList_Draw
ImageList_DragShowNolock
ImageList_DragMove
ImageList_DragLeave
ImageList_GetImageCount
ImageList_Destroy
ImageList_Create
ImageList_Copy
ImageList_BeginDrag
ImageList_Add
FlatSB_SetScrollProp
FlatSB_SetScrollPos
FlatSB_SetScrollInfo
FlatSB_GetScrollPos
FlatSB_GetScrollInfo
ImageList_Read
ImageList_Remove
ImageList_Replace
ImageList_ReplaceIcon
ImageList_SetBkColor
ImageList_SetIconSize
ImageList_SetImageCount
ImageList_Write
ord17
InitCommonControlsEx
InitializeFlatSB
_TrackMouseEvent
ImageList_DragEnter

imm32

ImmGetContext
ImmGetOpenStatus
ImmReleaseContext

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 157KB - Virtual size: 157KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 111KB - Virtual size: 111KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3e1f9ea03a2ad48fa17163729fd60d85

Code Sign

7e:1a:90:8b:37:b5:c7:66:b7:9a:e8:f5:5a:15:24:f6Certificate

Extended Key Usages

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77Certificate

Extended Key Usages

Key Usages

6f:cc:ec:f6:c6:9f:01:86:eb:f2:19:a0:2d:92:a6:17:3a:f0:28:08:9a:3d:31:64:50:b3:8f:04:87:af:be:fbSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

shlwapi

comctl32

imm32

Sections

.text Size: 25KB - Virtual size: 24KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 157KB - Virtual size: 157KB

.rsrc Size: 111KB - Virtual size: 111KB

7e:1a:90:8b:37:b5:c7:66:b7:9a:e8:f5:5a:15:24:f6
Certificate

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

6f:cc:ec:f6:c6:9f:01:86:eb:f2:19:a0:2d:92:a6:17:3a:f0:28:08:9a:3d:31:64:50:b3:8f:04:87:af:be:fb
Signer

.text
Size: 25KB - Virtual size: 24KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 157KB - Virtual size: 157KB

.rsrc
Size: 111KB - Virtual size: 111KB