084e7a83293243ca79f96351ea27deec_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

084e7a83293243ca79f96351ea27deec_JaffaCakes118
Size

696KB
MD5

084e7a83293243ca79f96351ea27deec
SHA1

49ec09b6d3417e1191c31e8bed4c71b3539266fa
SHA256

6414a5bf998e7a7302abb1db44b7a5b551fcab83360f3c650b8c574f933c487d
SHA512

83ff970ba2b3e96b127a0c1e67af632e3f39413528a20707a1726ab75b237933b5dfbea022ec14eb96eb1d9e7cc3fcbb907447833265b2946b95ea563eb59832
SSDEEP

12288:ACN/Gxqb7nqgUUNtMY/6cwW3SfbNP89qge5WvlvsX+Yi/j0qmLmJ:ATxMnD/C+SfbNPieAJi+L0qmLq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Keygen/keygen.exe

Files

084e7a83293243ca79f96351ea27deec_JaffaCakes118
.rar
ASF Digital GEM v1.10 For WinXP.exe
.exe windows:4 windows x86 arch:x86

3df1cad47b0f4f27a8eb25481d61d147

Code Sign

4a:19:d2:38:8c:82:59:1c:a5:5d:73:5f:15:5d:dc:a3
Certificate

Issuer

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

Not Before

12/05/1997, 00:00

Not After

07/01/2004, 23:59

Subject

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

71:78:4c:eb:cf:5a:6b:23:6e:a7:da:e5:f5:37:ca:b8
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

03/12/2001, 00:00

Not After

02/12/2011, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2001 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)01,O=VeriSign\, Inc.

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

08:7a:6d:5c:6f:62:93:4f:ba:c4:fd:43:e1:14:18:9d
Certificate

Issuer

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

Not Before

28/02/2001, 00:00

Not After

06/01/2004, 23:59

Subject

CN=VeriSign Time Stamping Service,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)01,O=VeriSign\, Inc.

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

19:8f:10:fc:e7:e2:d2:e7:87:e5:e8:e3:e2:18:37:5f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2001 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)01,O=VeriSign\, Inc.

Not Before

05/02/2003, 00:00

Not After

11/02/2004, 23:59

Subject

CN=Applied Science Fiction,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Software,O=Applied Science Fiction,L=Austin,ST=Texas,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerLanguageNameA

shell32

SHGetMalloc
SHGetPathFromIDListA
SHBrowseForFolderA

comctl32

ord17

kernel32

QueryPerformanceFrequency
InterlockedDecrement
InterlockedIncrement
lstrcatA
WriteFile
CreateEventA
CompareStringW
GetVersionExA
Sleep
CompareStringA
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
SetFilePointer
GetProcAddress
LoadLibraryA
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
LockResource
SetFileAttributesA
FreeLibrary
FindResourceA
CreateProcessA
GetModuleFileNameA
lstrcmpA
GetSystemDefaultLCID
GlobalHandle
SetLastError
SetCurrentDirectoryA
DeleteFileA
lstrlenW
WaitForSingleObject
GetSystemInfo
IsValidCodePage
FlushFileBuffers
LocalFree
FormatMessageA
GetDiskFreeSpaceA
_lclose
OpenFile
GetDriveTypeA
CreateDirectoryA
GetFileAttributesA
RemoveDirectoryA
GetExitCodeProcess
GetCurrentProcess
GetCurrentThread
GetLocaleInfoA
lstrcpyA
GetPrivateProfileStringA
lstrlenA
CreateFileA
GetFileSize
GlobalAlloc
CloseHandle
GlobalLock
ReadFile
GlobalUnlock
GlobalFree
GetLastError
WideCharToMultiByte
CopyFileA
MultiByteToWideChar
CreateThread
GetExitCodeThread
GetTickCount
lstrcmpiA
ExpandEnvironmentStringsA
GetPrivateProfileIntA
GetTempPathA
SetErrorMode
GetWindowsDirectoryA
GetTempFileNameA
WritePrivateProfileStringA
GetPrivateProfileSectionA
MoveFileA
LoadResource
SizeofResource
SetHandleCount
RaiseException
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetOEMCP
GetEnvironmentStringsW
GetStdHandle
GetACP
GetCPInfo
SetUnhandledExceptionFilter
DeleteCriticalSection
InitializeCriticalSection
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentVariableA
TlsGetValue
TlsAlloc
TlsSetValue
GetCurrentThreadId
HeapSize
HeapReAlloc
LeaveCriticalSection
EnterCriticalSection
GetVersion
GetCommandLineA
GetStartupInfoA
GetModuleHandleA
TerminateProcess
ExitProcess
SetStdHandle
HeapAlloc
HeapFree
RtlUnwind
SystemTimeToFileTime
QueryPerformanceCounter
ResetEvent
SetEvent
lstrcpynA
SearchPathA
FindFirstFileA
VirtualProtect
VirtualQuery
FindClose
IsBadReadPtr
GetStringTypeA
GetStringTypeW
LCMapStringW
LCMapStringA
IsBadCodePtr
GetFileType

user32

MessageBoxA
ReleaseDC
GetDC
DispatchMessageA
TranslateMessage
GetMessageA
CreateWindowExA
RegisterClassA
LoadCursorA
LoadIconA
SetTimer
PostQuitMessage
KillTimer
PostMessageA
DefWindowProcA
PeekMessageA
MsgWaitForMultipleObjects
wsprintfA
GetDesktopWindow
DialogBoxParamA
ShowWindow
GetDlgItem
EndDialog
GetWindowDC
SetWindowPos
ClientToScreen
GetClientRect
SetWindowLongA
EndPaint
BeginPaint
GetWindowLongA
WaitForInputIdle
CreateDialogParamA
CharNextA
SendDlgItemMessageA
ExitWindowsEx
CharPrevA
LoadStringA
wvsprintfA
GetClassInfoA
UpdateWindow
SetCursor
GetDlgItemTextA
EnableWindow
GetParent
GetWindowTextLengthA
GetWindowTextA
MoveWindow
GetWindowPlacement
DrawIcon
GetDlgCtrlID
SetWindowTextA
FillRect
GetSysColor
GetSysColorBrush
IsDialogMessageA
SendMessageA
GetWindowRect
FindWindowA
IntersectRect
SubtractRect
IsWindow
DestroyWindow
SetRect
GetSystemMetrics
DestroyIcon
CharLowerBuffA

gdi32

RealizePalette
GetDeviceCaps
CreatePalette
GetSystemPaletteEntries
GetStockObject
DeleteObject
DeleteDC
BitBlt
SelectObject
CreateCompatibleDC
CreateSolidBrush
CreateFontIndirectA
GetObjectA
SetTextColor
SetBkMode
GetTextExtentPointA
TranslateCharsetInfo
CreateDIBitmap
SelectPalette

advapi32

EqualSid
RegQueryValueA
RegOpenKeyA
RegCloseKey
RegQueryValueExA
OpenThreadToken
GetTokenInformation
AllocateAndInitializeSid
RegCreateKeyExA
FreeSid
RegOpenKeyExA
RegDeleteValueA
RegSetValueExA
RegEnumValueA
RegDeleteKeyA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken

ole32

CreateItemMoniker
CoCreateGuid
StringFromCLSID
StgIsStorageFile
StgOpenStorage
CoTaskMemFree
CoCreateInstance
CoUninitialize
CoInitialize
GetRunningObjectTable

oleaut32

SysReAllocStringLen
SysFreeString
SysAllocString
SysAllocStringLen
SysStringLen
VariantClear
VariantChangeType

Sections

.text
Size: 124KB - Virtual size: 121KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 48KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Keygen/keygen.exe
.exe windows:4 windows x86 arch:x86

2f920e6dd6a8adc1da7216571989c859

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
ExitProcess
GetModuleHandleA

advapi32

RegCloseKey

comctl32

ImageList_Add

gdi32

BitBlt

shell32

ShellExecuteA

user32

ActivateKeyboardLayout

oleaut32

SafeArrayCreate

Exports

Exports

@@Unit1@Finalize
@@Unit1@Initialize
_Form1
__GetExceptDLLinfo
___CPPdebugHook

Sections

pec1
Size: 232KB - Virtual size: 548KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Keygen/scotch.nfo

Sharing

General

Malware Config

Signatures

Files

3df1cad47b0f4f27a8eb25481d61d147

Code Sign

4a:19:d2:38:8c:82:59:1c:a5:5d:73:5f:15:5d:dc:a3Certificate

71:78:4c:eb:cf:5a:6b:23:6e:a7:da:e5:f5:37:ca:b8Certificate

Extended Key Usages

Key Usages

08:7a:6d:5c:6f:62:93:4f:ba:c4:fd:43:e1:14:18:9dCertificate

Extended Key Usages

Key Usages

19:8f:10:fc:e7:e2:d2:e7:87:e5:e8:e3:e2:18:37:5fCertificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

Imports

version

shell32

comctl32

kernel32

user32

gdi32

advapi32

ole32

oleaut32

Sections

.text Size: 124KB - Virtual size: 121KB

.rdata Size: 16KB - Virtual size: 14KB

.data Size: 20KB - Virtual size: 34KB

.rsrc Size: 48KB - Virtual size: 46KB

2f920e6dd6a8adc1da7216571989c859

Headers

File Characteristics

Imports

kernel32

advapi32

comctl32

gdi32

shell32

user32

oleaut32

Exports

Exports

Sections

pec1 Size: 232KB - Virtual size: 548KB

.rsrc Size: 12KB - Virtual size: 36KB

.rsrc Size: 1KB - Virtual size: 4KB

4a:19:d2:38:8c:82:59:1c:a5:5d:73:5f:15:5d:dc:a3
Certificate

71:78:4c:eb:cf:5a:6b:23:6e:a7:da:e5:f5:37:ca:b8
Certificate

08:7a:6d:5c:6f:62:93:4f:ba:c4:fd:43:e1:14:18:9d
Certificate

19:8f:10:fc:e7:e2:d2:e7:87:e5:e8:e3:e2:18:37:5f
Certificate

.text
Size: 124KB - Virtual size: 121KB

.rdata
Size: 16KB - Virtual size: 14KB

.data
Size: 20KB - Virtual size: 34KB

.rsrc
Size: 48KB - Virtual size: 46KB

pec1
Size: 232KB - Virtual size: 548KB

.rsrc
Size: 12KB - Virtual size: 36KB

.rsrc
Size: 1KB - Virtual size: 4KB