fd7e0ecc41735d3ba0329e1e311689f8_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

fd7e0ecc41735d3ba0329e1e311689f8_JaffaCakes118
Size

490KB
MD5

fd7e0ecc41735d3ba0329e1e311689f8
SHA1

c380038a57ffb8c064851b898f630312fabcbba7
SHA256

4013d3c221c6924e8c525aac7ed0402bd5349a28dcbc20bc1ff6bd09079faacf
SHA512

92e340197abf23700e1346ed90264b52a8291538681387f510bb0ca4336c80de554dad60ce38798f560f36e772c160efdfe77ca8662cb6edd1f0ea00c998da25
SSDEEP

6144:2EyNhCB7EF6k4WF1IjWSkKbfk/zZ7PM0Zo+5g1CCyyTieTt:2E0YEF65E+hyzDZo+ECMOeTt

Score

1^/10

Malware Config

Signatures

Files

fd7e0ecc41735d3ba0329e1e311689f8_JaffaCakes118
.exe windows:5 windows x64 arch:x64

07cdbde8cc7c84c1308fcd4f5135d31f

Code Sign

12:90:f2:41:d9:b2:80:af:77:fc:da:12:c6:b4:96:9c
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

15/10/2015, 00:00

Not After

14/10/2016, 23:59

Subject

CN=Solid Loop Ltd,O=Solid Loop Ltd,POSTALCODE=BN3 6HA,STREET=Unit 11 Hove Business Centre Fonthill Road,L=Hove,ST=East Sussex,C=GB,2.5.4.18=#1307424e3320364841

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f2:d8:87:4e:36:8b:25:09:c3:66:89:b1:f1:07:1c:47:d2:1b:b4:10
Signer

Actual PE Digest

f2:d8:87:4e:36:8b:25:09:c3:66:89:b1:f1:07:1c:47:d2:1b:b4:10

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

__getmainargs
_acmdln
exit
_cexit
_exit
_c_exit
_XcptFilter
_initterm
_wcsdup
wcscmp
wcsstr
_wcslwr
free
_snwprintf
__setusermatherr
_commode
_fmode
__set_app_type
__C_specific_handler
vswprintf
strcpy
vsprintf
wcscpy
strncmp
??2@YAPEAX_K@Z
??3@YAXPEAX@Z
memset
wcslen
swprintf
strlen
sprintf
_wcsicmp
memcpy

kernel32

GetStartupInfoA
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
LoadResource
FindResourceW
FreeResource
LocalFree
GetCurrentThread
FreeLibrary
QueryPerformanceCounter
EnterCriticalSection
GetEnvironmentVariableA
HeapValidate
HeapCreate
LeaveCriticalSection
WideCharToMultiByte
InitializeCriticalSection
SetFilePointer
CreateFileA
GetThreadContext
GetFileSize
SetThreadContext
HeapAlloc
GetCurrentProcess
HeapFree
WaitForSingleObject
GetModuleHandleW
VirtualFree
OpenProcess
VirtualFreeEx
LoadLibraryW
Sleep
ReadProcessMemory
GetVersionExW
ReadFile
CreateFileW
MultiByteToWideChar
GetLastError
GetProcAddress
VirtualAlloc
VirtualAllocEx
OpenThread
GetModuleHandleA
VirtualProtect
DuplicateHandle
CloseHandle
SuspendThread
ResumeThread
GetCommandLineW
HeapReAlloc
CreateMutexW
GetProcessHeap
WaitNamedPipeW
WriteFile
OpenMutexW
GetProcessHeaps
GetLocalTime
SetNamedPipeHandleState
GetCurrentThreadId
ReleaseMutex
GetCurrentProcessId

user32

RegisterClassExA
UnregisterClassA
CreateWindowExA
SendMessageW
DefWindowProcW
EnumThreadWindows
DestroyWindow

advapi32

EqualSid
GetLengthSid
IsValidSid
LookupAccountNameW
CopySid
GetTokenInformation
GetSidSubAuthorityCount
GetUserNameW
OpenThreadToken
GetSidSubAuthority
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 128B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 492B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 443KB - Virtual size: 443KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

07cdbde8cc7c84c1308fcd4f5135d31f

Code Sign

12:90:f2:41:d9:b2:80:af:77:fc:da:12:c6:b4:96:9cCertificate

Extended Key Usages

Key Usages

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate

Extended Key Usages

Key Usages

f2:d8:87:4e:36:8b:25:09:c3:66:89:b1:f1:07:1c:47:d2:1b:b4:10Signer

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

kernel32

user32

advapi32

Sections

.text Size: 28KB - Virtual size: 27KB

.rdata Size: 13KB - Virtual size: 13KB

.data Size: 512B - Virtual size: 128B

.pdata Size: 512B - Virtual size: 492B

.rsrc Size: 443KB - Virtual size: 443KB

12:90:f2:41:d9:b2:80:af:77:fc:da:12:c6:b4:96:9c
Certificate

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

f2:d8:87:4e:36:8b:25:09:c3:66:89:b1:f1:07:1c:47:d2:1b:b4:10
Signer

.text
Size: 28KB - Virtual size: 27KB

.rdata
Size: 13KB - Virtual size: 13KB

.data
Size: 512B - Virtual size: 128B

.pdata
Size: 512B - Virtual size: 492B

.rsrc
Size: 443KB - Virtual size: 443KB