fff5a75eca2706ef0798abef762fbe60_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

fff5a75eca2706ef0798abef762fbe60_JaffaCakes118
Size

4.5MB
MD5

fff5a75eca2706ef0798abef762fbe60
SHA1

da025900ad032a94fe17f6951e7c1dd6828456df
SHA256

2d55181662e75517a080e29a5a8177929e9d2ac20819654daebf1f6d49fc2119
SHA512

db6be1fac480a46229a77c2da9cd31da0df348d5d94fe8174566f53021b94ea99cbd777db5891280d5c96bf50fa7fa6d8d8fe1f4965621a5607e9ebc1a657535
SSDEEP

98304:nd7vpQMS7yQsBWYKWiHHF9FgirtbklJ0ETq0SY4JhxbEtrXs:dm9psC5gu5Lr3JhxbOXs

Score

1^/10

Malware Config

Signatures

Files

fff5a75eca2706ef0798abef762fbe60_JaffaCakes118
.exe windows:4 windows x86 arch:x86

2b3812e7ce308ef814b09c5904198023

Code Sign

02:00:00:00:00:00:d6:78:b7:94:05
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

01/09/1998, 12:00

Not After

28/01/2014, 12:00

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

01:00:00:00:00:01:0a:ac:1a:2f:14
Certificate

Issuer

CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE

Not Before

18/04/2006, 08:24

Not After

18/04/2007, 08:24

Subject

CN=Systemdoctor\, Ltd,O=Systemdoctor\, Ltd,C=UA,1.2.840.113549.1.9.1=#0c167265706b6f4073797374656d646f63746f722e636f6d

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageKeyEncipherment
KeyUsageDataEncipherment

04:00:00:00:00:01:08:d9:61:1c:d6
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

28/01/1999, 12:00

Not After

27/01/2014, 11:00

Subject

CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

04:00:00:00:00:01:08:d9:61:24:48
Certificate

Issuer

CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE

Not Before

22/01/2004, 09:00

Not After

27/01/2014, 10:00

Subject

CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCommandLineA
CreateProcessA
CloseHandle
WaitForSingleObject
GetExitCodeProcess
DeleteFileA
Sleep
FindResourceA
SizeofResource
GetTempPathA
LockResource
CreateFileA
WriteFile
lstrlenA
GetModuleHandleA
GetModuleFileNameA
SetFilePointer
ReadFile
GetLastError
LoadResource

user32

LoadStringA

advapi32

RegCloseKey
RegSetValueExA
RegCreateKeyExA

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4.5MB - Virtual size: 4.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2b3812e7ce308ef814b09c5904198023

Code Sign

02:00:00:00:00:00:d6:78:b7:94:05Certificate

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

01:00:00:00:00:01:0a:ac:1a:2f:14Certificate

Key Usages

04:00:00:00:00:01:08:d9:61:1c:d6Certificate

Key Usages

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88Certificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:08:d9:61:24:48Certificate

Key Usages

Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

Sections

.text Size: 3KB - Virtual size: 3KB

.rdata Size: 1KB - Virtual size: 1KB

.data Size: 512B - Virtual size: 20B

.rsrc Size: 4.5MB - Virtual size: 4.5MB

02:00:00:00:00:00:d6:78:b7:94:05
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

01:00:00:00:00:01:0a:ac:1a:2f:14
Certificate

04:00:00:00:00:01:08:d9:61:1c:d6
Certificate

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

04:00:00:00:00:01:08:d9:61:24:48
Certificate

.text
Size: 3KB - Virtual size: 3KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 20B

.rsrc
Size: 4.5MB - Virtual size: 4.5MB