fdd97a831b0d6a3e2607d9de1809b0ba_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

fdd97a831b0d6a3e2607d9de1809b0ba_JaffaCakes118
Size

86KB
MD5

fdd97a831b0d6a3e2607d9de1809b0ba
SHA1

c1cef977c3847c16a184dc7ddcfee2ecf805882a
SHA256

21e4b17ad5a2f8458a5d09fe9399971b458af151b3047dc5b0a8cb9fe609e024
SHA512

3e858539f56521a5a21390d245eafe27badc0821d367fb5a35cdcec188ff4545329dfbfc40ff3226daeb25ad7a8b10a8b23b43920eb58c3c80440fa9e3cf53f8
SSDEEP

1536:206fYhNYPAEivW7m2rZ+bLAjXqkFTpyA54IAzZG:206Zr4sqK9yA54NY

Score

1^/10

Malware Config

Signatures

Files

fdd97a831b0d6a3e2607d9de1809b0ba_JaffaCakes118
.dll windows:5 windows x86 arch:x86

3e4b0476553f52083344d6cf6caf45af

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

08:0c:4f:b0:0e:d9:77:80:67:19:61:b4:cd:f8:6b:ca
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

06/09/2011, 00:00

Not After

10/09/2012, 12:00

Subject

CN=Boxore OU,O=Boxore OU,L=Tallinn,C=EE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

07:f4:73:6f:af:ef:40:8a:1f:66:40:f2:65:d1:0a:c1
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/02/2011, 12:00

Not After

10/02/2026, 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2f:1c:19:6d:a5:bf:08:4a:67:89:e1:c6:52:cb:06:b4:a8:f8:f9:50
Signer

Actual PE Digest

2f:1c:19:6d:a5:bf:08:4a:67:89:e1:c6:52:cb:06:b4:a8:f8:f9:50

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Workspace\boxore_client\Release\BoxoreInstallerCA\BoxoreInstallerCA.pdb

Imports

psapi

GetModuleFileNameExW
EnumProcesses

kernel32

CopyFileW
OpenProcess
TerminateProcess
CloseHandle
lstrlenW
GetLastError
WideCharToMultiByte
MultiByteToWideChar
GetCurrentProcessId
GetModuleFileNameA
WriteFile
GetPrivateProfileIntW
CreateFileA
HeapAlloc
GetProcessHeap
HeapReAlloc
HeapSize
HeapFree
GetModuleFileNameW
GlobalFindAtomW
GlobalDeleteAtom
SetLastError
GlobalAddAtomW
GetTickCount
GetPrivateProfileStringW
SetFilePointer
GetCurrentProcess
GlobalAlloc
GlobalFree
FlushFileBuffers
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoA
GetCurrentThreadId
GetCommandLineA
RaiseException
RtlUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
Sleep
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
GetConsoleCP
GetConsoleMode
EnterCriticalSection
LeaveCriticalSection
VirtualAlloc
LoadLibraryA
InitializeCriticalSectionAndSpinCount
LCMapStringA
GetStringTypeA
GetStringTypeW

advapi32

RegOpenKeyExW
RegCloseKey
RegQueryValueExW

shell32

SHGetFolderPathW

msi

ord74
ord103
ord17
ord124
ord49
ord8
ord73

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Exports

Exports

InstallFirefoxUserJS
KillAllProcesses

Sections

.text
Size: 53KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3e4b0476553f52083344d6cf6caf45af

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

08:0c:4f:b0:0e:d9:77:80:67:19:61:b4:cd:f8:6b:caCertificate

Extended Key Usages

Key Usages

07:f4:73:6f:af:ef:40:8a:1f:66:40:f2:65:d1:0a:c1Certificate

Extended Key Usages

Key Usages

2f:1c:19:6d:a5:bf:08:4a:67:89:e1:c6:52:cb:06:b4:a8:f8:f9:50Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

psapi

kernel32

advapi32

shell32

msi

version

Exports

Exports

Sections

.text Size: 53KB - Virtual size: 52KB

.rdata Size: 13KB - Virtual size: 13KB

.data Size: 4KB - Virtual size: 15KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 7KB - Virtual size: 6KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

08:0c:4f:b0:0e:d9:77:80:67:19:61:b4:cd:f8:6b:ca
Certificate

07:f4:73:6f:af:ef:40:8a:1f:66:40:f2:65:d1:0a:c1
Certificate

2f:1c:19:6d:a5:bf:08:4a:67:89:e1:c6:52:cb:06:b4:a8:f8:f9:50
Signer

.text
Size: 53KB - Virtual size: 52KB

.rdata
Size: 13KB - Virtual size: 13KB

.data
Size: 4KB - Virtual size: 15KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 7KB - Virtual size: 6KB