04bc37d74e432cdbddb45899e6671aaf_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

04bc37d74e432cdbddb45899e6671aaf_JaffaCakes118
Size

826KB
MD5

04bc37d74e432cdbddb45899e6671aaf
SHA1

804d598c7b1fc560136ee87c5a65a64b2c8c1477
SHA256

5a87381b73c371a5f0f60c42d7918c2e9c5115ce848cedffe11de6e998a7f281
SHA512

29e1d99758d0c5fa3a5c9164dc158c4423e7af627312b31f0029382e7cec8f95b5b9411a984741c7e572d88ad42cd1fd1a8ff1a6f7549415f03044435ceafe68
SSDEEP

12288:16J99N9GgrK57EdKn5dVIwzdjYQ7Vf8Sp:4J99Nwb9IqYGVf8Sp

Score

1^/10

Malware Config

Signatures

Files

04bc37d74e432cdbddb45899e6671aaf_JaffaCakes118
.exe windows:5 windows x86 arch:x86

2eb07d70b634f4558a608bcdb09e5f33

Code Sign

38:93:02:7c:66:b2:6d:65:7a:5f:53:87:54:db:cc:25
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

22/06/2016, 00:00

Not After

22/06/2017, 23:59

Subject

CN=OOO \"BAYKAL FORT AYTI\",O=OOO \"BAYKAL FORT AYTI\",POSTALCODE=664011,STREET=Dzergynskogo\, 25\, of.511,L=Irkutsk,ST=Irkutskaya,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

4c:aa:f9:ca:db:63:6f:e0:1f:f7:4e:d8:5b:03:86:9d
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

19/01/2010, 00:00

Not After

18/01/2038, 23:59

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

95:c0:6a:b2:fd:f2:89:47:fa:2f:79:30:57:8f:09:82:7f:9f:2b:73:5a:26:81:69:bf:be:da:20:ef:49:60:6d
Signer

Actual PE Digest

95:c0:6a:b2:fd:f2:89:47:fa:2f:79:30:57:8f:09:82:7f:9f:2b:73:5a:26:81:69:bf:be:da:20:ef:49:60:6d

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetConsoleOutputCP
GetConsoleScreenBufferInfo
GetCurrentProcess
GetCurrentThread
GetFileType
GetLastError
GetLocaleInfoW
GetModuleFileNameW
GetModuleHandleW
GetOEMCP
GetProcessAffinityMask
GetProcessHeap
GetStdHandle
GetStringTypeExW
GetSystemDefaultLCID
GetThreadLocale
GetUserDefaultLCID
GetUserDefaultUILanguage
GetConsoleMode
HeapAlloc
HeapFree
LoadLibraryW
LocalFree
MultiByteToWideChar
Process32NextW
ReadConsoleW
ReadFile
SetConsoleMode
SetConsoleOutputCP
SetConsoleTextAttribute
SetThreadAffinityMask
SetThreadLocale
SystemTimeToFileTime
WriteConsoleW
WriteFile
GetConsoleAliasesW
FreeLibrary
FormatMessageW
FindNextFileW
FindFirstFileW
FindClose
FileTimeToSystemTime
FatalAppExitA
CreateFileW
CloseHandle
BackupWrite
GetDriveTypeW
GetModuleHandleA
VirtualAllocEx
GetVersionExW

user32

LoadCursorA
CharToOemW
LoadStringW
SendMessageA
LoadCursorW

gdi32

CLIPOBJ_bEnum
GdiConvertToDevmodeW
GetCharWidthFloatA
GetObjectW
SelectPalette
EngFillPath
EnumFontsW
GetWorldTransform

advapi32

RegOpenKeyExW
RegCloseKey
RegOpenKeyW
RegQueryValueExW
RegSetValueExW

shell32

SHGetMalloc
SHEmptyRecycleBinA
DragQueryFile
ExtractIconEx
SHChangeNotify
ShellExecuteW
SHPathPrepareForWriteA
SHCreateProcessAsUserW

shlwapi

StrChrA

msvcrt

_XcptFilter
__getmainargs
__initenv
__p__commode
__p__fmode
__set_app_type
__setusermatherr
__wgetmainargs
__winitenv
_adjust_fdiv
_c_exit
_cexit
_controlfp
_except_handler3
_exit
_ftol
_getmbcp
_initterm
_wcsicmp
_wcslwr
_wcsnicmp
_wfopen
_wmakepath
_wsplitpath
_wtoi
_wtol
ceil
exit
fclose
fgetws
fwprintf
printf
setlocale
sprintf
swprintf
wcscmp
wcscpy
wcslen
wcsncpy
wcsstr
wcstod
wcstok
wprintf

Sections

.text
Size: 197KB - Virtual size: 196KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 533KB - Virtual size: 533KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2eb07d70b634f4558a608bcdb09e5f33

Code Sign

38:93:02:7c:66:b2:6d:65:7a:5f:53:87:54:db:cc:25Certificate

Extended Key Usages

Key Usages

4c:aa:f9:ca:db:63:6f:e0:1f:f7:4e:d8:5b:03:86:9dCertificate

Key Usages

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate

Extended Key Usages

Key Usages

95:c0:6a:b2:fd:f2:89:47:fa:2f:79:30:57:8f:09:82:7f:9f:2b:73:5a:26:81:69:bf:be:da:20:ef:49:60:6dSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

shlwapi

msvcrt

Sections

.text Size: 197KB - Virtual size: 196KB

.rdata Size: 50KB - Virtual size: 50KB

.data Size: 533KB - Virtual size: 533KB

.rsrc Size: 39KB - Virtual size: 38KB

38:93:02:7c:66:b2:6d:65:7a:5f:53:87:54:db:cc:25
Certificate

4c:aa:f9:ca:db:63:6f:e0:1f:f7:4e:d8:5b:03:86:9d
Certificate

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

95:c0:6a:b2:fd:f2:89:47:fa:2f:79:30:57:8f:09:82:7f:9f:2b:73:5a:26:81:69:bf:be:da:20:ef:49:60:6d
Signer

.text
Size: 197KB - Virtual size: 196KB

.rdata
Size: 50KB - Virtual size: 50KB

.data
Size: 533KB - Virtual size: 533KB

.rsrc
Size: 39KB - Virtual size: 38KB