1336eb5206930cd61a5a0c1a44aa60a2_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

1336eb5206930cd61a5a0c1a44aa60a2_JaffaCakes118
Size

203KB
MD5

1336eb5206930cd61a5a0c1a44aa60a2
SHA1

5b4aa1ef6ce41c01348c0a825dd67c78af6cfa79
SHA256

cfc6d2bb8b7595de25a4f1117b183cdb8b061bc1e1fea0d64d1aa5f788f1e5ef
SHA512

daf991a107a28a4ae4f7f35dd4c56219e031333209e02529c31c68b658e8fa080686a2aec0e9c5378124ab3370b131ee0b497c5ffc59091d883e27678db76452
SSDEEP

6144:uPkUpSa2l4ZITThYyRb9/K2IPFaI9704:YkUpnIR//KT59

Score

1^/10

Malware Config

Signatures

Files

1336eb5206930cd61a5a0c1a44aa60a2_JaffaCakes118
.dll windows:5 windows x86 arch:x86

cd5fc37626be115bdae0bbf4bf725f5d

Code Sign

51:58:4f:24:8d:a8:48:41:bb:97:df:9f:a7:44:ce:9c
Certificate

Issuer

CN=oCa3Pc5NCgcd

Not Before

16/03/2012, 08:46

Not After

31/12/2039, 23:59

Subject

CN=oCa3Pc5NCgcd

Extended Key Usages

ExtKeyUsageCodeSigning

46:d1:99:ea:56:94:8e:47:46:98:da:32:ef:9f:95:eb:a9:d2:0a:60
Signer

Actual PE Digest

46:d1:99:ea:56:94:8e:47:46:98:da:32:ef:9f:95:eb:a9:d2:0a:60

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrlenA
lstrcpyA
CreateFileA
ExitProcess
GetWindowsDirectoryA
VirtualAlloc

user32

CascadeChildWindows
CharUpperA
DrawTextExW
EnableMenuItem
EnumDisplaySettingsW
GetDlgItemTextA
GetMenuItemInfoW
GetSystemMenu
GrayStringW
LoadMenuW
PostMessageA
RegisterClassW
TrackPopupMenu
UnregisterClassW
CharLowerBuffW

comdlg32

ReplaceTextW
ReplaceTextA
PrintDlgW
PrintDlgExW
PrintDlgExA
PrintDlgA
PageSetupDlgW
PageSetupDlgA
GetSaveFileNameW
GetSaveFileNameA
GetOpenFileNameW
GetOpenFileNameA
GetFileTitleW
GetFileTitleA
FindTextW
FindTextA
CommDlgExtendedError
ChooseFontW
ChooseFontA
ChooseColorW
ChooseColorA

advapi32

RegOpenKeyW

ole32

OleDraw
OleDuplicateData
OleGetClipboard
OleInitialize
OleInitializeWOW
OleLoad
OleUninitialize
ProgIDFromCLSID
PropStgNameToFmtId
ReadClassStg
ReadOleStg
RegisterDragDrop
ReleaseStgMedium
SNB_UserMarshal
STGMEDIUM_UserMarshal
StgCreateDocfileOnILockBytes
StgCreatePropSetStg
StgGetIFillLockBytesOnILockBytes
StgOpenPropStg
StgSetTimes
UpdateDCOMSettings
WriteClassStg
WriteClassStm
WriteFmtUserTypeStg
WriteOleStg
HMETAFILE_UserFree
HMENU_UserMarshal
HGLOBAL_UserFree
HENHMETAFILE_UserUnmarshal
HENHMETAFILE_UserMarshal
HDC_UserUnmarshal
HDC_UserFree
OleDoAutoConvert
HACCEL_UserUnmarshal
GetHGlobalFromILockBytes
GetDocumentBitStg
GetConvertStg
GetClassFile
EnableHookObject
CreatePointerMoniker
CreateOleAdviseHolder
CreateILockBytesOnHGlobal
CreateAntiMoniker
CoUnmarshalInterface
CoUninitialize
CoTestCancel
CoSwitchCallContext
CoResumeClassObjects
CoReleaseServerProcess
CoImpersonateClient
CoGetTreatAsClass
CoGetStdMarshalEx
CoGetInstanceFromIStorage
CoGetCurrentLogicalThreadId
CoGetClassObject
CoGetCancelObject
CoGetCallerTID
CoGetCallContext
CoFreeLibrary
CoFreeAllLibraries
CoCreateInstance
CoCreateGuid
CoCancelCall
CoBuildVersion
CLSIDFromString
CLIPFORMAT_UserUnmarshal
BindMoniker
OleCreateStaticFromData
OleCreateMenuDescriptor
OleCreateLinkToFileEx
OleCreateLinkFromDataEx
OleCreateLinkEx
OleCreateFromFileEx
OleCreateFromDataEx
OleCreateFromData
OleConvertIStorageToOLESTREAMEx
HMETAFILE_UserMarshal
MkParseDisplayName
HWND_UserFree
HPALETTE_UserSize
HPALETTE_UserMarshal
HBRUSH_UserUnmarshal
HPALETTE_UserFree
OleConvertIStorageToOLESTREAM

comctl32

CreatePropertySheetPageA
CreatePropertySheetPageW
CreateStatusWindow
ord6
ord7
_TrackMouseEvent
UninitializeFlatSB
ord3
PropertySheetW
PropertySheetA
PropertySheet
ord2
ord13
InitializeFlatSB
InitMUILanguage
InitCommonControlsEx
ord17
ImageList_Write
ImageList_SetImageCount
ImageList_SetIconSize
ImageList_SetFilter
CreatePropertySheetPage
ord15
DrawStatusText
DrawStatusTextW
FlatSB_EnableScrollBar
FlatSB_GetScrollInfo
FlatSB_GetScrollRange
FlatSB_SetScrollInfo
FlatSB_SetScrollPos
FlatSB_SetScrollProp
FlatSB_ShowScrollBar
ord4
GetMUILanguage
ImageList_Add
ImageList_AddMasked
ImageList_BeginDrag
ImageList_Create
ImageList_Destroy
ImageList_DragLeave
ImageList_DragMove
ImageList_Draw
ord8
CreateToolbarEx
ImageList_SetBkColor
ImageList_ReplaceIcon
ImageList_Replace
ImageList_Remove
ImageList_Merge
ImageList_LoadImageW
ImageList_LoadImageA
ImageList_LoadImage
ImageList_GetImageInfo
ImageList_GetIconSize
ImageList_GetBkColor
ImageList_EndDrag
ImageList_DrawIndirect
ImageList_DrawEx

Sections

.text
Size: 188KB - Virtual size: 188KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text4
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.text3
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cd5fc37626be115bdae0bbf4bf725f5d

Code Sign

51:58:4f:24:8d:a8:48:41:bb:97:df:9f:a7:44:ce:9cCertificate

Extended Key Usages

46:d1:99:ea:56:94:8e:47:46:98:da:32:ef:9f:95:eb:a9:d2:0a:60Signer

Headers

File Characteristics

Imports

kernel32

user32

comdlg32

advapi32

ole32

comctl32

Sections

.text Size: 188KB - Virtual size: 188KB

.data Size: 512B - Virtual size: 88B

.text4 Size: 1024B - Virtual size: 1000B

.text3 Size: 2KB - Virtual size: 2KB

.rsrc Size: 7KB - Virtual size: 6KB

.reloc Size: 2KB - Virtual size: 1KB

51:58:4f:24:8d:a8:48:41:bb:97:df:9f:a7:44:ce:9c
Certificate

46:d1:99:ea:56:94:8e:47:46:98:da:32:ef:9f:95:eb:a9:d2:0a:60
Signer

.text
Size: 188KB - Virtual size: 188KB

.data
Size: 512B - Virtual size: 88B

.text4
Size: 1024B - Virtual size: 1000B

.text3
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 7KB - Virtual size: 6KB

.reloc
Size: 2KB - Virtual size: 1KB