085b5cd38616bc49feea3d328e2a82f4_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

085b5cd38616bc49feea3d328e2a82f4_JaffaCakes118
Size

1.1MB
MD5

085b5cd38616bc49feea3d328e2a82f4
SHA1

6858e8198ed39deef5d903505617d76eb9d7d9b9
SHA256

6a07401ad0dc4dab6638af44e2153876a30f630987ab7c2c28a1c7efdf8222e8
SHA512

bb31529c8cfb7e8e19028170cb4d212f1cf466a1d71ea9d5de6897b70ebd05cb3e62e2e0b2fa0ef547a76eb0b6cfee08d7cd9c171e43431366af3e596384555f
SSDEEP

24576:WomW7kuvWIZg/wH2SD9xtWQdpwx1BiD1GnPEXIn2tEEEEEEEEEEdlhJEJEEEEEEJ:WZW7gC+SDPLdEK1GnPEXdtEEEEEEEEE3

Score

1^/10

Malware Config

Signatures

Files

085b5cd38616bc49feea3d328e2a82f4_JaffaCakes118
.exe windows:5 windows x86 arch:x86

29d3b771448090795e82c39d861c0fc7

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

27:ea:b3:de:0b:03:d8:8d:5c:4a:2a:e4:77:b8:4d:fa
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

16/04/2012, 00:00

Not After

08/04/2015, 23:59

Subject

CN=APN LLC,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Distribution,O=APN LLC,L=Oakland,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

94:1a:ab:d2:76:4d:8c:78:9c:c5:56:49:3d:6a:ed:b9:04:04:d8:fb
Signer

Actual PE Digest

94:1a:ab:d2:76:4d:8c:78:9c:c5:56:49:3d:6a:ed:b9:04:04:d8:fb

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\hudson\jobs\EVEREST_BUILD\workspace\IECore\Release\TBNotifier.pdb

Imports

msi

ord70
ord195

kernel32

SetEvent
CreateEventW
CreateMutexW
ReleaseMutex
WideCharToMultiByte
OpenProcess
Process32NextW
CreateToolhelp32Snapshot
GetCurrentProcessId
CopyFileW
WriteFile
DeleteFileW
GetPrivateProfileStringW
GetTempFileNameW
GetTempPathW
CreateDirectoryW
ResetEvent
CreateThread
WaitForMultipleObjects
FreeLibrary
LoadLibraryW
InitializeCriticalSectionAndSpinCount
lstrcmpiW
LoadLibraryExW
FileTimeToSystemTime
GetFileTime
OutputDebugStringW
UnlockFile
LockFile
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
FormatMessageW
GetSystemDefaultLangID
CompareFileTime
GetFileAttributesW
DeleteFileA
AreFileApisANSI
GetSystemTime
GetTempPathA
GetVersionExA
LoadLibraryA
LockFileEx
GetFileAttributesA
FormatMessageA
GetFileSize
GetFullPathNameA
GetFullPathNameW
SetEnvironmentVariableA
CompareStringW
SetEndOfFile
CreateFileA
SetStdHandle
WriteConsoleW
LockResource
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetTickCount
CreateFileW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetTimeZoneInformation
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetFileType
SetHandleCount
GetStringTypeW
IsValidCodePage
GetOEMCP
GetACP
GetLocaleInfoW
GetStdHandle
HeapCreate
ExitProcess
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
LCMapStringW
GetStartupInfoW
HeapSetInformation
GetCommandLineW
GetDateFormatW
GetTimeFormatW
GetSystemTimeAsFileTime
VirtualQuery
GetSystemInfo
VirtualProtect
RtlUnwind
ExitThread
DecodePointer
EncodePointer
HeapSize
HeapReAlloc
HeapDestroy
InterlockedPopEntrySList
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
HeapAlloc
GetProcessHeap
HeapFree
InterlockedPushEntrySList
InterlockedCompareExchange
GlobalFree
GetCurrentThreadId
InitializeCriticalSection
SizeofResource
RaiseException
InterlockedExchange
InterlockedIncrement
WaitForSingleObject
FindResourceExW
FindResourceW
ReadFile
InterlockedDecrement
LocalFree
GetModuleHandleW
GetProcAddress
GetVersionExW
Sleep
GlobalHandle
SetLastError
GetModuleFileNameW
MulDiv
lstrcmpW
lstrlenW
lstrlenA
MultiByteToWideChar
GetCurrentProcess
FlushInstructionCache
GetLastError
GlobalAlloc
GlobalUnlock
GlobalLock
CloseHandle
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
QueryPerformanceCounter
LoadResource

user32

MoveWindow
GetClientRect
BeginPaint
SendMessageW
GetDC
ReleaseDC
UpdateWindow
PostMessageW
EndPaint
GetWindowLongW
GetWindow
EnumWindows
DestroyWindow
DrawTextW
SetWindowLongW
GetSysColor
CreateWindowExW
SetWindowPos
SendDlgItemMessageW
SetWindowContextHelpId
IsWindow
UnhookWinEvent
MapDialogRect
EndDialog
CharNextW
ClientToScreen
ScreenToClient
InvalidateRect
InvalidateRgn
RedrawWindow
ShowWindow
IsWindowVisible
SetTimer
UnregisterClassA
GetWindowInfo
EnableWindow
DefWindowProcW
GetWindowThreadProcessId
LoadStringW
SetCapture
IsChild
GetParent
GetDlgItem
LoadAcceleratorsW
TranslateAcceleratorW
GetSysColorBrush
PostQuitMessage
SetForegroundWindow
WindowFromPoint
GetClassNameW
ReleaseCapture
FillRect
CallWindowProcW
GetDesktopWindow
DestroyAcceleratorTable
GetFocus
SetFocus
GetClassInfoExW
KillTimer
SendMessageTimeoutW
MessageBoxW
FindWindowW
SystemParametersInfoW
SetRectEmpty
PostThreadMessageW
MsgWaitForMultipleObjects
PeekMessageW
LoadCursorW
EnumChildWindows
PtInRect
SetDlgItemTextW
LoadImageW
DrawIconEx
GetActiveWindow
DialogBoxIndirectParamW
SetLayeredWindowAttributes
SetWinEventHook
TranslateMessage
DispatchMessageW
GetMessageW
CreateDialogIndirectParamW
RegisterWindowMessageW
GetWindowRect
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
CreateAcceleratorTableW
RegisterClassExW

gdi32

Rectangle
GetTextExtentPoint32W
StretchBlt
GetDIBColorTable
CreateFontIndirectW
CreateSolidBrush
GetDeviceCaps
BitBlt
CreateCompatibleBitmap
GetStockObject
SetBkMode
SetTextColor
CreateDIBSection
DeleteObject
GetObjectW
SetDIBColorTable
SelectObject
DeleteDC
CreateCompatibleDC
CreatePen

advapi32

RegQueryValueExW
RegDeleteValueW
RegEnumKeyExW
RegOpenKeyExW
RegCreateKeyExW
RegSetValueExW
RegCloseKey
RegEnumValueW
RegQueryInfoKeyW
RegFlushKey
RegNotifyChangeKeyValue
RegDeleteKeyW

shell32

SHGetFolderPathW
ShellExecuteW

ole32

CoUninitialize
CoInitialize
CreateStreamOnHGlobal
StringFromGUID2
OleLockRunning
CoGetClassObject
CLSIDFromProgID
CLSIDFromString
CoCreateInstance
CoTaskMemAlloc
OleInitialize
OleUninitialize
CoTaskMemFree
CoCreateGuid
CoTaskMemRealloc
CoAddRefServerProcess
CoReleaseServerProcess

oleaut32

VarUdateFromDate
VarDateFromStr
VarUI4FromStr
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayCreate
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayDestroy
SafeArrayCopy
SafeArrayGetVartype
VariantCopy
VarBstrCmp
VariantChangeType
SysFreeString
SysStringLen
VariantClear
SysAllocStringLen
SysAllocString
VariantInit
OleCreateFontIndirect
LoadRegTypeLi
LoadTypeLi
SysAllocStringByteLen

shlwapi

StrStrIW
PathFileExistsW

gdiplus

GdipCloneImage
GdipDrawImageI
GdipGetImageGraphicsContext
GdiplusShutdown
GdiplusStartup
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipDisposeImage
GdipDeleteGraphics
GdipAlloc
GdipFree

msimg32

AlphaBlend
TransparentBlt

psapi

GetModuleFileNameExW

crypt32

CryptMsgGetParam
CryptQueryObject
CertGetNameStringW
CertFindCertificateInStore

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

oleacc

AccessibleObjectFromEvent
AccessibleObjectFromWindow
GetRoleTextW
AccessibleChildren
WindowFromAccessibleObject

wininet

HttpOpenRequestW
HttpSendRequestW
InternetSetOptionW
InternetReadFile
InternetCloseHandle
InternetCrackUrlW
InternetConnectW
InternetOpenW
HttpQueryInfoW

comctl32

ord17

Sections

.text
Size: 716KB - Virtual size: 715KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 160KB - Virtual size: 160KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 210KB - Virtual size: 210KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 47KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

29d3b771448090795e82c39d861c0fc7

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:edCertificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fdCertificate

Extended Key Usages

Key Usages

27:ea:b3:de:0b:03:d8:8d:5c:4a:2a:e4:77:b8:4d:faCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

94:1a:ab:d2:76:4d:8c:78:9c:c5:56:49:3d:6a:ed:b9:04:04:d8:fbSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msi

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

gdiplus

msimg32

psapi

crypt32

version

oleacc

wininet

comctl32

Sections

.text Size: 716KB - Virtual size: 715KB

.rdata Size: 160KB - Virtual size: 160KB

.data Size: 20KB - Virtual size: 31KB

.rsrc Size: 210KB - Virtual size: 210KB

.reloc Size: 47KB - Virtual size: 46KB

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

27:ea:b3:de:0b:03:d8:8d:5c:4a:2a:e4:77:b8:4d:fa
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

94:1a:ab:d2:76:4d:8c:78:9c:c5:56:49:3d:6a:ed:b9:04:04:d8:fb
Signer

.text
Size: 716KB - Virtual size: 715KB

.rdata
Size: 160KB - Virtual size: 160KB

.data
Size: 20KB - Virtual size: 31KB

.rsrc
Size: 210KB - Virtual size: 210KB

.reloc
Size: 47KB - Virtual size: 46KB