ffd18f33280545b39744aa569f18adbd_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

ffd18f33280545b39744aa569f18adbd_JaffaCakes118
Size

78KB
MD5

ffd18f33280545b39744aa569f18adbd
SHA1

35e2716dba785c873a4a792b2e6d01dd56e7e9e8
SHA256

12e3fe6bacadb9aa711f371f839b061efc96f8f62aef01b5f36d9c59b46bdfba
SHA512

091a5c00d0c775720d1284609f4d1a37d9788ae97a85688ca147f062a5eb3c3f817998481db44ab5e8093c32e3a8ead5e5669e27f6bff6fcb0861b1be5aa97f9
SSDEEP

1536:KGCylAIPH13cUxRG2nR0bdjPkcc7wlCsWjcdtIVKYqkv7:KGIIPF9CkFwltmVKav7

Score

1^/10

Malware Config

Signatures

Files

ffd18f33280545b39744aa569f18adbd_JaffaCakes118
.dll windows:6 windows x86 arch:x86

4598533a0c3b6c5ddb9612a89de425ce

Code Sign

3d:56:ba:23:44:98:c1:5c:23:83:f5:f9:9e:6d:e0:73
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

01/06/2015, 00:00

Not After

31/05/2016, 23:59

Subject

CN=MOSCOW COMPANY,O=MOSCOW COMPANY,L=Moscow,ST=Moscow,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

23:68:7c:6a:a5:bd:0f:03:99:2d:7a:90:5b:13:33:1b:36:83:98:83
Signer

Actual PE Digest

23:68:7c:6a:a5:bd:0f:03:99:2d:7a:90:5b:13:33:1b:36:83:98:83

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

nspr4

PR_SetError
PR_Calloc
PR_ErrorToName
PR_GetOSError
PR_GetError
PR_fprintf
PR_GetSpecialFD
PR_Free
PR_Malloc

kernel32

Sleep
CreateFileW
CloseHandle
WriteConsoleW
SetFilePointerEx
SetStdHandle
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetStringTypeW
GetLastError
HeapFree
HeapAlloc
GetCommandLineA
GetCurrentThreadId
GetProcessHeap
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
GetProcAddress
MultiByteToWideChar
WideCharToMultiByte
GetStdHandle
WriteFile
GetModuleFileNameW
IsProcessorFeaturePresent
SetLastError
GetFileType
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
IsDebuggerPresent
EnterCriticalSection
LeaveCriticalSection
LoadLibraryExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
OutputDebugStringW
RtlUnwind
HeapReAlloc
HeapSize
LCMapStringW

Exports

Exports

PL_Base64Decode
PL_Base64Encode
PL_CreateLongOptState
PL_CreateOptState
PL_DestroyOptState
PL_FPrintError
PL_GetNextOpt
PL_PrintError
PL_strcasecmp
PL_strcaserstr
PL_strcasestr
PL_strcat
PL_strcatn
PL_strchr
PL_strcmp
PL_strcpy
PL_strdup
PL_strfree
PL_strlen
PL_strncasecmp
PL_strncaserstr
PL_strncasestr
PL_strncat
PL_strnchr
PL_strncmp
PL_strncpy
PL_strncpyz
PL_strndup
PL_strnlen
PL_strnpbrk
PL_strnprbrk
PL_strnrchr
PL_strnrstr
PL_strnstr
PL_strpbrk
PL_strprbrk
PL_strrchr
PL_strrstr
PL_strstr
PL_strtok_r
libVersionPoint

Sections

.text
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 744B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4598533a0c3b6c5ddb9612a89de425ce

Code Sign

3d:56:ba:23:44:98:c1:5c:23:83:f5:f9:9e:6d:e0:73Certificate

Extended Key Usages

Key Usages

23:68:7c:6a:a5:bd:0f:03:99:2d:7a:90:5b:13:33:1b:36:83:98:83Signer

Headers

DLL Characteristics

File Characteristics

Imports

nspr4

kernel32

Exports

Exports

Sections

.text Size: 46KB - Virtual size: 46KB

.rdata Size: 19KB - Virtual size: 19KB

.data Size: 4KB - Virtual size: 11KB

.rsrc Size: 1024B - Virtual size: 744B

.reloc Size: 3KB - Virtual size: 3KB

3d:56:ba:23:44:98:c1:5c:23:83:f5:f9:9e:6d:e0:73
Certificate

23:68:7c:6a:a5:bd:0f:03:99:2d:7a:90:5b:13:33:1b:36:83:98:83
Signer

.text
Size: 46KB - Virtual size: 46KB

.rdata
Size: 19KB - Virtual size: 19KB

.data
Size: 4KB - Virtual size: 11KB

.rsrc
Size: 1024B - Virtual size: 744B

.reloc
Size: 3KB - Virtual size: 3KB