046c3a286a627010b36348a43bdc2dc0_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

046c3a286a627010b36348a43bdc2dc0_JaffaCakes118
Size

116KB
MD5

046c3a286a627010b36348a43bdc2dc0
SHA1

5ee18b77d48f27b9cd41187bf2dda56e872896c0
SHA256

e6310be0168c3cc3e35679161bfd7d3197aa1dde185d6f5e70ede37a0d3e5fce
SHA512

fe5ceed6452d3b2d4ddb0aba0bd8fab94c15cd2c48871c35c3d8c8f1ffd88743dc47ab0459f9696baee1fd0499af51c25cd0542b3797f49bb32a5b8b2ba7f30a
SSDEEP

3072:DrGgPQa5LkiXV3cohjx6ZUG5Ho5rzab5v:uRmV3cohQSG5I5Had

Score

1^/10

Malware Config

Signatures

Files

046c3a286a627010b36348a43bdc2dc0_JaffaCakes118
.exe windows:4 windows x86 arch:x86

bc44e30256145c4a222ad9e1811268b9

Code Sign

4a:19:d2:38:8c:82:59:1c:a5:5d:73:5f:15:5d:dc:a3
Certificate

Issuer

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

Not Before

12/05/1997, 00:00

Not After

07/01/2004, 23:59

Subject

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

4a:29:3e:9d:1d:8c:40:7f:17:49:ff:7d:61:5f:8e:75
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

12/12/2001, 00:00

Not After

06/01/2004, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2001-4 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)01,O=VeriSign\, Inc.

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

08:7a:6d:5c:6f:62:93:4f:ba:c4:fd:43:e1:14:18:9d
Certificate

Issuer

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

Not Before

28/02/2001, 00:00

Not After

06/01/2004, 23:59

Subject

CN=VeriSign Time Stamping Service,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)01,O=VeriSign\, Inc.

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

21:0f:c8:b5:67:a8:68:9f:a2:36:fd:5e:26:91:56:22
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2001-4 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)01,O=VeriSign\, Inc.

Not Before

09/09/2002, 00:00

Not After

22/09/2003, 23:59

Subject

CN=Autodesk\, Inc,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Design Solutions Division,O=Autodesk\, Inc,L=San Rafael,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

U:\global\Release\bin\acad\AcSignApply.pdb

Imports

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

shlwapi

PathCanonicalizeA
PathFindExtensionA
PathRemoveFileSpecA
PathFindFileNameA

userdata

?GetProductRegistryRootKey@@YGIPADK@Z

mfc70

ord4516
ord4671
ord4361
ord1870
ord1523
ord1522
ord1403
ord300
ord2990
ord682
ord705
ord686
ord977
ord1081
ord1472
ord1469
ord4267
ord3748
ord4025
ord4933
ord1760
ord4854
ord5989
ord3966
ord3208
ord4503
ord4063
ord1452
ord5714
ord812
ord817
ord821
ord819
ord823
ord2239
ord2223
ord2242
ord2237
ord2214
ord2216
ord2234
ord2026
ord2675
ord2020
ord1377
ord5993
ord3610
ord5991
ord3890
ord3152
ord4748
ord1234
ord4954
ord1814
ord1508
ord1507
ord1451
ord4972
ord2201
ord2024
ord1180
ord2846
ord2896
ord1871
ord571
ord331
ord2865
ord2864
ord2199
ord1416
ord362
ord3993
ord3003
ord4013
ord1936
ord1397
ord2972
ord2766
ord4019
ord1942
ord3679
ord3683
ord2679
ord5631
ord5629
ord5624
ord1493
ord1423
ord3037
ord1646
ord650
ord447
ord4015
ord1781
ord1344
ord3884
ord1939
ord2712
ord1399
ord2979
ord257
ord4530
ord4021
ord1945
ord1443
ord3124
ord5473
ord5760
ord503
ord1626
ord3886
ord1944
ord5880
ord1155
ord2200
ord1805
ord3051
ord1744
ord956
ord2799
ord1097
ord1273
ord1755
ord4986
ord4101
ord5591
ord2012
ord3565
ord5815
ord2474
ord518
ord703
ord5474
ord302
ord656
ord1495
ord1433
ord3099
ord1267
ord5838
ord5007
ord5005
ord2219
ord2229
ord2227
ord2225
ord2221
ord2244
ord2232
ord546
ord4975
ord4043
ord1272
ord5666
ord4958
ord3445
ord4985
ord5002
ord3750
ord4996
ord2741
ord1770
ord532
ord1077
ord1014
ord599
ord3140
ord512
ord3640
ord5152
ord5933
ord4883
ord899
ord3614
ord5339
ord1868
ord1913
ord4107
ord5990
ord3609
ord5992
ord4322
ord2096
ord5322
ord4349
ord4998
ord3814
ord698
ord3487
ord3832
ord528
ord982
ord561
ord592
ord957
ord4042
ord4262
ord3751
ord2461
ord3513
ord3523
ord3522
ord2352
ord2463
ord2359
ord2651
ord2529
ord4088
ord2648
ord2546
ord2356
ord1406
ord5669

msvcr70

_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_amsg_exit
_acmdln
exit
_cexit
_XcptFilter
_exit
_c_exit
?terminate@@YAXXZ
_onexit
__dllonexit
__CxxFrameHandler
_mbscmp
_tzname
_tzset
_ismbcspace
strchr
_mbsicoll
_mbsicmp
_vscprintf
atof
_mbsinc
_mbsrchr
malloc
free
_CxxThrowException
_setmbcp
??1type_info@@UAE@XZ
vsprintf
memmove

kernel32

GetModuleFileNameA
LockResource
LoadLibraryA
GetThreadLocale
InterlockedExchange
MultiByteToWideChar
GetACP
GetEnvironmentVariableA
SizeofResource
WideCharToMultiByte
LoadResource
FreeLibrary
GetLocaleInfoA
lstrlenA
FindResourceA
GetVersion
GetComputerNameA
LocalFree
GetTimeFormatA
GetDateFormatA
GetFileAttributesA
GetTimeZoneInformation
FindFirstFileA
SetFileAttributesA
FindClose
FindNextFileA
GetCurrentDirectoryA
CreateFileA
SetFilePointer
IsDBCSLeadByte
ReadFile
GetLastError
CloseHandle
SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime
FileTimeToSystemTime
GetProcAddress
GetModuleHandleA
GetStartupInfoA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
InterlockedDecrement
GetVersionExA

user32

MessageBoxA
PostQuitMessage
PeekMessageA
GetWindowRect
IsIconic
GetSubMenu
GetFocus
LoadMenuA
LoadIconA
DrawIcon
GetClientRect
SendMessageA
PtInRect
WinHelpA
EnableMenuItem
GetSysColor
GetDesktopWindow
EnableWindow
GetKeyState
GetSystemMetrics

advapi32

RegQueryValueExA
RegSetValueExA
RegCloseKey
RegEnumValueA
RegOpenKeyExA
RegCreateKeyExA

shell32

SHGetMalloc
SHBrowseForFolderA
SHGetPathFromIDListA
ShellExecuteExA
DragQueryFileA
ShellExecuteA
DragFinish

comctl32

ImageList_ReplaceIcon

ole32

CoInitialize
CoTaskMemFree
CoCreateInstance
CoUninitialize

oleaut32

SysAllocString
SysFreeString
VariantClear

Sections

.text
Size: 54KB - Virtual size: 53KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.yvs
Size: - Virtual size: 1B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

bc44e30256145c4a222ad9e1811268b9

Code Sign

4a:19:d2:38:8c:82:59:1c:a5:5d:73:5f:15:5d:dc:a3Certificate

4a:29:3e:9d:1d:8c:40:7f:17:49:ff:7d:61:5f:8e:75Certificate

Extended Key Usages

Key Usages

08:7a:6d:5c:6f:62:93:4f:ba:c4:fd:43:e1:14:18:9dCertificate

Extended Key Usages

Key Usages

21:0f:c8:b5:67:a8:68:9f:a2:36:fd:5e:26:91:56:22Certificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

PDB Paths

Imports

version

shlwapi

userdata

mfc70

msvcr70

kernel32

user32

advapi32

shell32

comctl32

ole32

oleaut32

Sections

.text Size: 54KB - Virtual size: 53KB

.rdata Size: 19KB - Virtual size: 19KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 35KB - Virtual size: 35KB

.yvs Size: - Virtual size: 1B

4a:19:d2:38:8c:82:59:1c:a5:5d:73:5f:15:5d:dc:a3
Certificate

4a:29:3e:9d:1d:8c:40:7f:17:49:ff:7d:61:5f:8e:75
Certificate

08:7a:6d:5c:6f:62:93:4f:ba:c4:fd:43:e1:14:18:9d
Certificate

21:0f:c8:b5:67:a8:68:9f:a2:36:fd:5e:26:91:56:22
Certificate

.text
Size: 54KB - Virtual size: 53KB

.rdata
Size: 19KB - Virtual size: 19KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 35KB - Virtual size: 35KB

.yvs
Size: - Virtual size: 1B