f09639a60d7e982384dd4cdd663691e1_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

f09639a60d7e982384dd4cdd663691e1_JaffaCakes118
Size

65KB
MD5

f09639a60d7e982384dd4cdd663691e1
SHA1

facb2e317a42a0d606ecbef1916488c181dac1f7
SHA256

91f9fcd9a464ff49e2886e8bdb555b4b9c250393870f980a816807e7b3cf4906
SHA512

624ba95d5b124aab43f4cd71da313fd2b2d117d35f92662ff06f554932d29ba8eb980ee2a108661c561a7fea27d28b82a0bc42731bc8b56392eb4e63f297cedc
SSDEEP

1536:4Vv5SYzhWfz0+1IpCSwpKvcpnFKlM8v3k4OyU31TmlR1nm2wRBzSy6nDNdb:4e/FI9wpPpAffkHyGa71nm2wTzWDN5

Score

1^/10

Malware Config

Signatures

Files

f09639a60d7e982384dd4cdd663691e1_JaffaCakes118
.exe windows:4 windows x86 arch:x86

a9c613962a7ef43e5e31a3cdf28477d8

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09-07-1999 18:31

Not After

09-07-2019 18:40

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

3d:49:cd:33:c1:1e:6c:1b:ba:e2:97:1e:37:76:c7:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

01-02-2008 00:00

Not After

31-01-2009 23:59

Subject

CN=InstallProvider Inc.,O=InstallProvider Inc.,POSTALCODE=DM,STREET=15 Cornwall Street,L=Roseau,ST=Dominica,C=DM

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

ScrollDC
CopyIcon
CheckMenuItem
SetScrollInfo
CreateIconIndirect
GetWindowInfo
SetProcessWindowStation
DestroyMenu
CharNextExA
GetShellWindow
RegisterWindowMessageA
ToUnicodeEx
GetKeyboardLayoutList
GetDoubleClickTime
DrawMenuBar
DdeGetLastError
GetComboBoxInfo
CreateDialogParamA
MessageBoxA
DdeClientTransaction
GetProcessDefaultLayout
TranslateAccelerator
EnumDisplayMonitors
TileWindows
GetScrollBarInfo
DefMDIChildProcA
GetWindowRect
ChildWindowFromPointEx
SwitchToThisWindow
GetClassInfoA
LoadIconA
DdeNameService
ShowCursor
GetMenuState
SetMessageExtraInfo
GetWindowWord
IMPGetIMEA
LoadMenuIndirectA
InvalidateRgn
RedrawWindow
AlignRects
WinHelpA
ChangeMenuA
GetClassWord
SetWindowRgn
GetTopWindow
IsCharLowerA
GetDC
DispatchMessageA
DdeCreateDataHandle
CascadeWindows
DdeUnaccessData
OpenDesktopA

advapi32

SetEntriesInAuditListA
CryptSignHashA
DeregisterEventSource
QueryServiceObjectSecurity
ControlService
GetTrusteeTypeA
CryptContextAddRef
EnumDependentServicesA
OpenEventLogA
RegOpenKeyA
RegConnectRegistryA
GetSecurityDescriptorOwner
GetServiceDisplayNameA
PrivilegeCheck
CryptEncrypt
GetAclInformation
CryptGetKeyParam
AllocateAndInitializeSid
RegSaveKeyA
GetMultipleTrusteeA
GetNumberOfEventLogRecords
ChangeServiceConfigA
BackupEventLogA
RegQueryValueA
RevertToSelf
RegDeleteValueA
ObjectDeleteAuditAlarmA
SetServiceStatus
RegUnLoadKeyA
GetSidSubAuthority
CryptGenKey
GetExplicitEntriesFromAclA
AddAce
FindFirstFreeAce
CryptDestroyHash
GetSecurityDescriptorControl
InitializeAcl

kernel32

GetPrivateProfileSectionNamesA

Sections

.ibito
Size: 22KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.fahmn
Size: 5KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.mdgrm
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.ulqh
Size: 27KB - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a9c613962a7ef43e5e31a3cdf28477d8

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1bCertificate

Extended Key Usages

Key Usages

3d:49:cd:33:c1:1e:6c:1b:ba:e2:97:1e:37:76:c7:0bCertificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

Imports

user32

advapi32

kernel32

Sections

.ibito Size: 22KB - Virtual size: 45KB

.fahmn Size: 5KB - Virtual size: 10KB

.mdgrm Size: 1KB - Virtual size: 2KB

.ulqh Size: 27KB - Virtual size: 140KB

.rsrc Size: 2KB - Virtual size: 4KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

3d:49:cd:33:c1:1e:6c:1b:ba:e2:97:1e:37:76:c7:0b
Certificate

.ibito
Size: 22KB - Virtual size: 45KB

.fahmn
Size: 5KB - Virtual size: 10KB

.mdgrm
Size: 1KB - Virtual size: 2KB

.ulqh
Size: 27KB - Virtual size: 140KB

.rsrc
Size: 2KB - Virtual size: 4KB