0e009428cc25430f8f55b0b922e389b2_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

0e009428cc25430f8f55b0b922e389b2_JaffaCakes118
Size

619KB
MD5

0e009428cc25430f8f55b0b922e389b2
SHA1

228f8e45bd2cbe91389279512d12acbb8ed6f51a
SHA256

748ae2cbcb84693d8dbe1cf2e17d87507a769ec71d923fb9c9a5744aaab4b61f
SHA512

140da2cae38943d53eabd6b6008ffd699ea97a1c8a9ad33d08790d4a251b7eee60f148f36feea92a5e7aaa2053746c6cfc037377810ad05306ca9a3af5271e4c
SSDEEP

12288:0JxUaFty+yr+Ts4e3kmYn0YaAsPEo8DIhM5wzTrr5t8Q2jWHAI:0gaFty+yr+Ts4e3kmYn0YaAshMWM5STJ

Score

1^/10

Malware Config

Signatures

Files

0e009428cc25430f8f55b0b922e389b2_JaffaCakes118
.dll windows:5 windows x86 arch:x86

3d19cdb07e0ff43e97ec9a74d65d36eb

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:0c:ab:11:d8:22:ef:7d:6c:79:7e
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

23/05/2002, 08:00

Not After

25/09/2011, 08:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:05:87:58:00:03:00:00:00:5a
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

05/01/2005, 23:20

Not After

05/04/2006, 23:30

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

24:73:7c:b6:2d:80:d2:f8:2f:ac:86:39:ea:16:f7:a9:30:ae:ad:58
Signer

Actual PE Digest

24:73:7c:b6:2d:80:d2:f8:2f:ac:86:39:ea:16:f7:a9:30:ae:ad:58

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

inet_ntoa
WSAStartup
select
connect
WSAIoctl
getpeername
getsockname
gethostbyname
closesocket
socket
recv
send
gethostname
htons
ntohs
setsockopt
WSACleanup

wininet

InternetOpenW
InternetReadFile
InternetCloseHandle
InternetOpenUrlW

shlwapi

StrCmpIW
StrRChrW
StrStrIW
StrStrW

imm32

ImmGetCompositionStringW
ImmReleaseContext
ImmGetContext

winmm

mixerSetControlDetails
mixerGetNumDevs
mixerGetDevCapsW
mixerGetLineInfoW
mixerClose
mixerGetControlDetailsW
waveInStart
mixerGetLineControlsW
waveOutUnprepareHeader
waveInAddBuffer
waveInOpen
waveInPrepareHeader
waveOutReset
waveOutPrepareHeader
waveOutGetNumDevs
waveOutOpen
mixerOpen
waveInUnprepareHeader
waveOutWrite
waveInClose
waveOutClose
waveInReset
waveInGetNumDevs

psapi

GetModuleFileNameExW
EnumProcessModules

userenv

CreateEnvironmentBlock

kernel32

GetModuleHandleA
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
TlsSetValue
LCMapStringW
HeapReAlloc
HeapAlloc
HeapFree
GetProcessHeap
WaitForSingleObject
SetEvent
GetTickCount
Sleep
CreateEventW
CloseHandle
lstrlenW
WideCharToMultiByte
lstrcpyW
ResetEvent
CancelIo
GetFileSize
FindFirstFileW
SetFilePointer
GetDriveTypeW
SetErrorMode
CreateProcessW
GetLogicalDriveStringsW
CreateDirectoryW
WriteFile
GetFileAttributesW
ReadFile
CreateFileW
lstrcmpW
GetLastError
MoveFileW
FindClose
RemoveDirectoryW
lstrcatW
FindNextFileW
GetDiskFreeSpaceExW
DeleteFileW
LocalFree
GetVolumeInformationW
GetCurrentProcess
TerminateThread
lstrcpynW
GetModuleFileNameW
InterlockedExchange
GetExitCodeThread
WaitForMultipleObjects
MapViewOfFile
UnmapViewOfFile
VirtualQuery
GetLocalTime
CreateFileMappingW
OutputDebugStringW
SetUnhandledExceptionFilter
GetModuleHandleW
FormatMessageW
IsBadWritePtr
FlushFileBuffers
GlobalSize
GlobalLock
InitializeCriticalSection
GlobalAlloc
LeaveCriticalSection
GlobalUnlock
EnterCriticalSection
GlobalFree
DeleteCriticalSection
lstrcmpiW
GetCurrentThreadId
GetCommandLineW
GetEnvironmentVariableW
SetPriorityClass
lstrlenA
GetCurrentThread
SetProcessPriorityBoost
LoadLibraryW
GetVersionExW
GetExitCodeProcess
SetThreadPriority
GetProcAddress
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
GetShortPathNameW
lstrcpyA
PeekNamedPipe
TerminateProcess
GetStartupInfoW
DisconnectNamedPipe
CreatePipe
ExpandEnvironmentStringsW
OpenProcess
HeapSize
LocalSize
MultiByteToWideChar
GlobalHandle
CreateThread
ExitThread
GetCommandLineA
UnhandledExceptionFilter
IsDebuggerPresent
TlsGetValue
TlsAlloc
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
ExitProcess
RaiseException
GetStdHandle
GetModuleFileNameA
HeapCreate
HeapDestroy
VirtualFree
VirtualAlloc
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
RtlUnwind
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
LCMapStringA

user32

GetKeyNameTextW
GetActiveWindow
GetWindowTextW
CallNextHookEx
wvsprintfW
mouse_event
SetClipboardData
SendMessageW
GetSystemMetrics
OpenClipboard
BlockInput
DestroyCursor
EmptyClipboard
SystemParametersInfoW
GetClipboardData
SetCursorPos
WindowFromPoint
LoadCursorW
SetWindowsHookExW
MapVirtualKeyW
CloseClipboard
keybd_event
GetCursorPos
GetDesktopWindow
ReleaseDC
SetRect
GetCursorInfo
GetDC
GetUserObjectInformationW
SetThreadDesktop
CloseDesktop
OpenDesktopW
OpenInputDesktop
PostMessageW
GetThreadDesktop
GetWindow
GetWindowThreadProcessId
IsWindowVisible
EnumWindows
DispatchMessageW
TranslateMessage
GetMessageW
UnhookWindowsHookEx
ExitWindowsEx
CharNextW
wsprintfW
GetClientRect
CreateWindowExW
CloseWindow
SetCapture

gdi32

BitBlt
DeleteDC
CreateDIBSection
GetDIBits
DeleteObject
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap

advapi32

CreateServiceW
AdjustTokenPrivileges
RegSetValueExW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
InitializeAcl
AllocateAndInitializeSid
AddAccessAllowedAce
FreeSid
ControlService
RegisterServiceCtrlHandlerW
SetServiceStatus
RegDeleteValueW
QueryServiceStatus
DuplicateTokenEx
StartServiceW
ChangeServiceConfig2W
SetTokenInformation
RegOpenKeyW
CreateProcessAsUserW
RegQueryValueExW
RegCreateKeyExW
OpenServiceW
OpenSCManagerW
DeleteService
CloseServiceHandle
GetLengthSid
RegQueryValueW
RegOpenKeyExW
RegCloseKey
OpenProcessToken
LookupPrivilegeValueW

shell32

SHChangeNotify
SHGetFileInfoW
ShellExecuteExW

ole32

CoInitialize
CoUninitialize
CoCreateInstance
CoTaskMemFree

oleaut32

SysFreeString

Exports

Exports

Install
Launch
ServiceMain
UnInstall

Sections

.text
Size: 462KB - Virtual size: 462KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rodata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 90KB - Virtual size: 90KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 25KB - Virtual size: 510KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.under
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

3d19cdb07e0ff43e97ec9a74d65d36eb

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88Certificate

Extended Key Usages

Key Usages

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate

6a:0b:99:4f:c0:00:0c:ab:11:d8:22:ef:7d:6c:79:7eCertificate

Extended Key Usages

Key Usages

61:05:87:58:00:03:00:00:00:5aCertificate

Extended Key Usages

Key Usages

24:73:7c:b6:2d:80:d2:f8:2f:ac:86:39:ea:16:f7:a9:30:ae:ad:58Signer

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

wininet

shlwapi

imm32

winmm

psapi

userenv

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 462KB - Virtual size: 462KB

.rodata Size: 11KB - Virtual size: 10KB

.rdata Size: 90KB - Virtual size: 90KB

.data Size: 25KB - Virtual size: 510KB

.rsrc Size: 1024B - Virtual size: 4KB

.reloc Size: 23KB - Virtual size: 22KB

.under Size: 5KB - Virtual size: 5KB

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

6a:0b:99:4f:c0:00:0c:ab:11:d8:22:ef:7d:6c:79:7e
Certificate

61:05:87:58:00:03:00:00:00:5a
Certificate

24:73:7c:b6:2d:80:d2:f8:2f:ac:86:39:ea:16:f7:a9:30:ae:ad:58
Signer

.text
Size: 462KB - Virtual size: 462KB

.rodata
Size: 11KB - Virtual size: 10KB

.rdata
Size: 90KB - Virtual size: 90KB

.data
Size: 25KB - Virtual size: 510KB

.rsrc
Size: 1024B - Virtual size: 4KB

.reloc
Size: 23KB - Virtual size: 22KB

.under
Size: 5KB - Virtual size: 5KB