07c5a8e5de01b528d1a0cfdaa5a2fafa_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

07c5a8e5de01b528d1a0cfdaa5a2fafa_JaffaCakes118
Size

655KB
MD5

07c5a8e5de01b528d1a0cfdaa5a2fafa
SHA1

c62c3d853d6515b8fe38afd5567fc6bd93a97f45
SHA256

8df831a93805c46016664fc0a4f5364798f10356fe2e45dbd275bd5ca1d632ac
SHA512

f4171a650ec082e9d4d1930bec2f1987b3548b2f758b198a21256accc271082e915392b0557093493d63c639982ccef0bdb0ca84d72d478cb204c0864d3dc97b
SSDEEP

12288:XMG4x1JMQzBL9oTpw+Zwa/+GagV0394Ww0Cg+jyLknCSZbX6kur:X/4xLvZ9ouO/5Z0jw7/jyLknCSZOkur

Score

1^/10

Malware Config

Signatures

Files

07c5a8e5de01b528d1a0cfdaa5a2fafa_JaffaCakes118
.exe windows:5 windows x86 arch:x86

e6675006db120639672e29a293be48e1

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

12:0b:25:dd:e5:7b:88:63:6a:d4:d9:7d:23:b9:9c:88
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

02/05/2013, 00:00

Not After

02/05/2015, 23:59

Subject

CN=Goobzo LTD,O=Goobzo LTD,L=Haifa,ST=Israel,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

61:1f:b0:a4:00:00:00:00:00:1d
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:31

Not After

22/02/2021, 19:41

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

bf:af:75:f3:a4:c0:f1:44:64:be:6c:10:30:c9:07:52:7d:3c:6c:cf
Signer

Actual PE Digest

bf:af:75:f3:a4:c0:f1:44:64:be:6c:10:30:c9:07:52:7d:3c:6c:cf

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Build_STUB\Installer\Release\YTDi.pdb

Imports

kernel32

TerminateProcess
GetVersionExW
GetLocalTime
GetModuleFileNameW
SetErrorMode
CreateProcessW
GetExitCodeProcess
SystemTimeToFileTime
FileTimeToSystemTime
CopyFileW
GetTempPathW
WideCharToMultiByte
CreateFileW
DeviceIoControl
SetFilePointer
SetEndOfFile
FreeLibrary
GetProcAddress
lstrcmpiW
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
FlushInstructionCache
GetFileSize
CreateDirectoryW
WriteFile
GetFileAttributesW
ReadFile
FlushFileBuffers
GetFileType
GetEnvironmentVariableW
GetSystemDirectoryW
InitializeCriticalSection
OutputDebugStringW
LoadLibraryW
MoveFileExW
SetEnvironmentVariableA
SetEnvironmentVariableW
CompareStringW
GetTimeZoneInformation
GetStringTypeW
CreateThread
GetEnvironmentStringsW
FreeEnvironmentStringsW
WriteConsoleW
SetHandleCount
SetStdHandle
LCMapStringW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
HeapCreate
GetStdHandle
ExitProcess
HeapSize
GetDateFormatA
GetTimeFormatA
IsDebuggerPresent
UnhandledExceptionFilter
SetConsoleCtrlHandler
RtlUnwind
GetStartupInfoW
HeapSetInformation
GetCommandLineW
HeapReAlloc
GetConsoleMode
GetConsoleCP
GetSystemTimeAsFileTime
DecodePointer
EncodePointer
InterlockedPopEntrySList
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
HeapAlloc
GetProcessHeap
HeapFree
InterlockedPushEntrySList
InterlockedCompareExchange
GetFileAttributesExW
GlobalAlloc
DuplicateHandle
OpenEventW
WaitForMultipleObjects
CreateEventW
ResetEvent
SetThreadPriority
MultiByteToWideChar
ExitThread
SetLastError
Sleep
TerminateThread
GetTickCount
SetEvent
WaitForSingleObject
GetCurrentProcess
InterlockedDecrement
InterlockedIncrement
GetCurrentThreadId
EnterCriticalSection
RaiseException
LeaveCriticalSection
GetModuleHandleW
GetCurrentProcessId
InterlockedExchange
CloseHandle
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
LocalFree
FormatMessageW
GetLastError
GlobalFree
WritePrivateProfileStringW
GetPrivateProfileStringW
SystemTimeToTzSpecificLocalTime
GetTempFileNameW
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
OpenFileMappingW
GetSystemInfo
DebugBreak
lstrlenA
SetUnhandledExceptionFilter
GetComputerNameW
lstrlenW
QueryPerformanceCounter

user32

MessageBoxW
wsprintfW
GetWindowTextW
FindWindowExW
SendMessageTimeoutW
MoveWindow
FindWindowW
IsWindowVisible
GetWindow
GetWindowLongW
EnumChildWindows
GetWindowThreadProcessId
GetParent
GetDlgItem
LoadBitmapW
SetWindowPos
MapWindowPoints
GetClientRect
GetWindowRect
GetMonitorInfoW
GetDC
UnregisterClassA
GetClassNameW
MonitorFromWindow
ShowWindow
SetWindowTextW
LoadIconW
SendMessageW
SetTimer
LoadStringW
SetWindowLongW
IsDialogMessageW
DispatchMessageW
MsgWaitForMultipleObjectsEx
DialogBoxParamW
DestroyWindow
DefWindowProcW
GetActiveWindow
CharNextW
EndDialog
GetMessageW
TranslateMessage
PeekMessageW
CreateDialogParamW

ws2_32

getaddrinfo
WSAStartup
connect
socket
send
closesocket
WSACleanup
WSAGetLastError
htons

gdi32

SetLayout

advapi32

SetSecurityDescriptorDacl
GetSidIdentifierAuthority
GetSidSubAuthorityCount
RegNotifyChangeKeyValue
RegEnumValueW
RegQueryValueW
RegOpenKeyW
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegQueryValueExW
RegEnumKeyW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
RegDeleteKeyW
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
GetUserNameW
InitializeSecurityDescriptor
LookupAccountNameW
GetSidSubAuthority
IsValidSid

shell32

SHFileOperationW
SHGetSpecialFolderPathW
ShellExecuteExW
SHGetFolderPathW

ole32

CoInitializeSecurity
CoCreateInstance
CoUninitialize
CoTaskMemFree
CoTaskMemRealloc
CoCreateGuid
CoTaskMemAlloc
CoInitialize
CoInitializeEx

oleaut32

VarUI4FromStr
SysAllocString
SysFreeString
VariantInit
VariantClear

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

rpcrt4

RpcStringFreeA
UuidToStringA

comctl32

InitCommonControlsEx

wininet

InternetOpenW
HttpSendRequestExW
InternetQueryDataAvailable
InternetReadFile
InternetConnectW
InternetWriteFile
HttpSendRequestW
InternetSetOptionW
HttpAddRequestHeadersW
HttpQueryInfoW
HttpOpenRequestW
InternetGetLastResponseInfoW
HttpEndRequestW
InternetCloseHandle

Sections

.text
Size: 391KB - Virtual size: 390KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 116KB - Virtual size: 116KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 95KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e6675006db120639672e29a293be48e1

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

12:0b:25:dd:e5:7b:88:63:6a:d4:d9:7d:23:b9:9c:88Certificate

Extended Key Usages

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5eCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

61:1f:b0:a4:00:00:00:00:00:1dCertificate

Key Usages

bf:af:75:f3:a4:c0:f1:44:64:be:6c:10:30:c9:07:52:7d:3c:6c:cfSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

ws2_32

gdi32

advapi32

shell32

ole32

oleaut32

version

rpcrt4

comctl32

wininet

Sections

.text Size: 391KB - Virtual size: 390KB

.rdata Size: 116KB - Virtual size: 116KB

.data Size: 13KB - Virtual size: 22KB

.rsrc Size: 95KB - Virtual size: 95KB

.reloc Size: 32KB - Virtual size: 31KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

12:0b:25:dd:e5:7b:88:63:6a:d4:d9:7d:23:b9:9c:88
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

61:1f:b0:a4:00:00:00:00:00:1d
Certificate

bf:af:75:f3:a4:c0:f1:44:64:be:6c:10:30:c9:07:52:7d:3c:6c:cf
Signer

.text
Size: 391KB - Virtual size: 390KB

.rdata
Size: 116KB - Virtual size: 116KB

.data
Size: 13KB - Virtual size: 22KB

.rsrc
Size: 95KB - Virtual size: 95KB

.reloc
Size: 32KB - Virtual size: 31KB