1300244219cb756df01536692edebdbb_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

1300244219cb756df01536692edebdbb_JaffaCakes118
Size

58KB
MD5

1300244219cb756df01536692edebdbb
SHA1

d59122c0b5ad7957509b7fe0dfe65853e407c809
SHA256

70c91ab469092ba56bd050a1e1d3f03a76ee8273b43f96233ac5519f989eefad
SHA512

d80bf048b16eccc6b453669fb7d94138ef3b9b860473da8512a53fba3351ce463fdf85d35ce248532d85c92e99aee364e9b6f5d1aea029200d9f1e35c3bbbe56
SSDEEP

1536:rm/DkeWjbDEH+UTaTQO93dQ1/9lj3qKjRg:ykeWjCOHKFlj3qKdg

Score

1^/10

Malware Config

Signatures

Files

1300244219cb756df01536692edebdbb_JaffaCakes118
.exe windows:4 windows x86 arch:x86

dc91ccc0c3d19e7fd95753883dc48fa7

Code Sign

01:00:00:00:00:01:1d:91:a4:6e:5b
Certificate

Issuer

CN=Cybertrust Educational CA,OU=Educational CA,O=Cybertrust,C=BE

Not Before

12/11/2008, 16:59

Not After

12/11/2011, 16:59

Subject

CN=stfmail.ccn.ac.uk,OU=I.T. Services,O=City College Norwich,L=Norwich,ST=Norfolk,C=GB

Key Usages

KeyUsageDigitalSignature
KeyUsageKeyEncipherment

04:00:03:fb
Certificate

Issuer

CN=GTE CyberTrust Global Root,OU=GTE CyberTrust Solutions\, Inc.,O=GTE Corporation,C=US

Not Before

14/03/2006, 20:30

Not After

14/03/2013, 23:59

Subject

CN=Cybertrust Educational CA,OU=Educational CA,O=Cybertrust,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

fc:b1:5c:6b:8d:58:38:ca:45:ba:a4:b5:50:22:98:90:94:40:77:33
Signer

Actual PE Digest

fc:b1:5c:6b:8d:58:38:ca:45:ba:a4:b5:50:22:98:90:94:40:77:33

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
VirtualAllocEx
OpenProcess
GetProcAddress
GetModuleHandleA
GetCurrentProcessId
GetSystemDirectoryA
Process32Next
Process32First
CreateToolhelp32Snapshot
MoveFileExA
WriteProcessMemory
CreateRemoteThread
CreateFileA
CreateDirectoryA
FlushFileBuffers
GetVersionExA
GetLastError
HeapFree
HeapAlloc
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
EnterCriticalSection
LeaveCriticalSection
WriteFile
InitializeCriticalSection
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
RtlUnwind
SetHandleCount
GetStdHandle
GetFileType
SetFilePointer
ReadFile
GetCPInfo
GetACP
GetOEMCP
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
GetCurrentThreadId
TlsSetValue
TlsAlloc
SetLastError
TlsGetValue
MultiByteToWideChar
LCMapStringA
LCMapStringW
SetStdHandle
InterlockedDecrement
InterlockedIncrement
GetStringTypeA
GetStringTypeW
LoadLibraryA
SetEndOfFile
GetFileAttributesA
SetFileAttributesA
CopyFileA
GetModuleFileNameA
DeleteCriticalSection
DeleteFileA

shell32

SHGetSpecialFolderPathA

advapi32

RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
FreeSid
CheckTokenMembership
RegCloseKey
AllocateAndInitializeSid

Sections

.text
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

dc91ccc0c3d19e7fd95753883dc48fa7

Code Sign

01:00:00:00:00:01:1d:91:a4:6e:5bCertificate

Key Usages

04:00:03:fbCertificate

Key Usages

fc:b1:5c:6b:8d:58:38:ca:45:ba:a4:b5:50:22:98:90:94:40:77:33Signer

Headers

File Characteristics

Imports

kernel32

shell32

advapi32

Sections

.text Size: 36KB - Virtual size: 33KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 12KB - Virtual size: 21KB

01:00:00:00:00:01:1d:91:a4:6e:5b
Certificate

04:00:03:fb
Certificate

fc:b1:5c:6b:8d:58:38:ca:45:ba:a4:b5:50:22:98:90:94:40:77:33
Signer

.text
Size: 36KB - Virtual size: 33KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 12KB - Virtual size: 21KB