102f46124eb8de72988cfbf86a606d30_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

102f46124eb8de72988cfbf86a606d30_JaffaCakes118
Size

81KB
MD5

102f46124eb8de72988cfbf86a606d30
SHA1

a68dab3b11be0db34e87d36485fe3c5574ffff6e
SHA256

abeaeda7318a903de7d73d0eaa7256099cd1055ec3c6a6b59f2aabbd8526cf94
SHA512

2d745a7c2ad160daf3ef20ca935a62e2f5f7370b844e1906f3b481ff3e76bcc098d6cfe92839c42cd6a854b5baa910513dd9757c222a5a0299180da9cb58121f
SSDEEP

768:E7aYURrkoORHnTPx+4d+7ofqqRJlnCf6FHS63iB9+G9c/RjQlF6g53GwymqA:GadRknTPxzcofqqdY/9m8lhEwymv

Score

1^/10

Malware Config

Signatures

Files

102f46124eb8de72988cfbf86a606d30_JaffaCakes118
.dll windows:4 windows x86 arch:x86

8cbe0a0a720d2b95d97bfc615ceafc42

Code Sign

3c:8e:1d:75:ad:49:9f:bc:76:e1:82:59:a7:58:cb:f3
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

04/01/2010, 00:00

Not After

04/01/2012, 23:59

Subject

CN=FS\+\+ Limited,O=FS\+\+ Limited,POSTALCODE=UB8 2TX,STREET=F1\, 23 New Windsor street,L=Uxbridge,ST=Middlesex,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

82:a9:76:5b:67:59:b8:57:35:4a:30:46:b8:44:3a:29:7b:3c:36:48
Signer

Actual PE Digest

82:a9:76:5b:67:59:b8:57:35:4a:30:46:b8:44:3a:29:7b:3c:36:48

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

shlwapi

StrStrIA

kernel32

HeapDestroy
HeapFree
ReadProcessMemory
HeapAlloc
GetProcessHeap
CloseHandle
CreateThread
GetModuleHandleA
WaitForSingleObject
CreateEventA
GetCommandLineA
GetVersion
GetProcAddress
ExitProcess
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
GetVersionExA
HeapCreate
VirtualFree
WriteFile
InterlockedDecrement
InterlockedIncrement
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
SetFilePointer
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
GetCPInfo
GetACP
GetOEMCP
VirtualAlloc
HeapReAlloc
LoadLibraryA
LCMapStringA
LCMapStringW
RtlUnwind
SetStdHandle
FlushFileBuffers

Exports

Exports

CleanupModule
FillMissingData
GetEngineStatus
GetModuleVar
ImportTable
InitializeModule
KeyHandler
SynchData
TriggerCommand

Sections

.text
Size: 44KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 800B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8cbe0a0a720d2b95d97bfc615ceafc42

Code Sign

3c:8e:1d:75:ad:49:9f:bc:76:e1:82:59:a7:58:cb:f3Certificate

Extended Key Usages

Key Usages

82:a9:76:5b:67:59:b8:57:35:4a:30:46:b8:44:3a:29:7b:3c:36:48Signer

Headers

File Characteristics

Imports

shlwapi

kernel32

Exports

Exports

Sections

.text Size: 44KB - Virtual size: 40KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 16KB - Virtual size: 17KB

.rsrc Size: 4KB - Virtual size: 800B

.reloc Size: 8KB - Virtual size: 4KB

3c:8e:1d:75:ad:49:9f:bc:76:e1:82:59:a7:58:cb:f3
Certificate

82:a9:76:5b:67:59:b8:57:35:4a:30:46:b8:44:3a:29:7b:3c:36:48
Signer

.text
Size: 44KB - Virtual size: 40KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 16KB - Virtual size: 17KB

.rsrc
Size: 4KB - Virtual size: 800B

.reloc
Size: 8KB - Virtual size: 4KB