136265288e181e2619b12935964eb1cd_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

136265288e181e2619b12935964eb1cd_JaffaCakes118
Size

161KB
MD5

136265288e181e2619b12935964eb1cd
SHA1

b5a5be520aef3aaa6a18baf9373c5a2fec1d2d7a
SHA256

a296d77c1bc15fda9ba394d1bc5ba1a001ac4cd7694d60da93a77cff59fb2d07
SHA512

433b58846956d335f3db764c9cc00dfb44317039d3e99ee55b8e88f77be21af23a9a6437e6c887b786979dec23859bfbc11acc5beb867c0ebf8cebd646c463f9
SSDEEP

3072:eBhM1tDkiAl85AAbUgmZY4+naDvOBBDJmoTLabX5CPSktaEV:O+1tIiz5dbH0OBHyggE

Score

1^/10

Malware Config

Signatures

Files

136265288e181e2619b12935964eb1cd_JaffaCakes118
.exe windows:4 windows x86 arch:x86

bdb0cb030bcfd4cf1c0d39c87b189170

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

04/04/2006, 17:44

Not After

26/04/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:46:9e:cb:00:04:00:00:00:65
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/04/2006, 19:43

Not After

04/10/2007, 19:53

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

e5:67:a4:d4:63:42:8e:5b:0f:87:5c:0a:07:7f:4d:52:21:61:bc:f9
Signer

Actual PE Digest

e5:67:a4:d4:63:42:8e:5b:0f:87:5c:0a:07:7f:4d:52:21:61:bc:f9

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

t:\outlook\x86\ship\0\cnfnot32.pdb

Imports

msvcr80

?terminate@@YAXXZ
_controlfp_s
_invoke_watson
_crt_debugger_hook
_except_handler4_common
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
exit
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
_setmbcp
_ismbblead
abort
_expand
_msize
longjmp
?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z
_ismbcdigit
_wcsicmp
wcschr
_mbschr
isspace
_strdup
_splitpath_s
_makepath_s
memmove
_vsnwprintf
_stricmp
_setjmp3
malloc
free
_vsnprintf
memcpy
??3@YAXPAX@Z
memset
?_type_info_dtor_internal_method@type_info@@QAEXXZ

shell32

SHGetFolderPathA

ole32

OleLoad
GetClassFile
StgCreateDocfile
OleCreateLinkToFile
OleSetContainedObject
StgOpenStorageOnILockBytes
StgIsStorageILockBytes
CoBuildVersion
CoRegisterClassObject
CoRevokeClassObject
OleSave
ReadClassStg

kernel32

InitializeCriticalSectionAndSpinCount
GetSystemDirectoryW
LoadLibraryExW
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
SystemTimeToFileTime
FileTimeToSystemTime
SetLastError
GetLastError
GetCurrentProcessId
CloseHandle
GetSystemTime
FreeLibrary
GetProcAddress
LoadLibraryW
GetModuleFileNameW
GetTimeFormatW
GetDateFormatW
FileTimeToLocalFileTime
GetModuleHandleA
GetModuleHandleW
GetFileAttributesW
GetVersion
lstrcmpiA
LoadLibraryA
OutputDebugStringA
MultiByteToWideChar
GetFileAttributesA
GetFileTime
CreateFileA
DeleteFileA
WriteFile
GetTempPathA
ReadFile
SetCurrentDirectoryA
lstrlenA
CompareFileTime
WaitForSingleObject
IsBadWritePtr
IsDBCSLeadByte
GetProfileStringA
GetSystemDefaultLCID
WideCharToMultiByte
GetACP
GetCurrentThreadId
lstrlenW
FreeResource
LockResource
LoadResource
GlobalAddAtomA
GetCurrentThread
TlsSetValue
SizeofResource
FindResourceW
TlsGetValue
LocalAlloc
FindResourceA
TlsAlloc
GetVersionExA
lstrcmpA
lstrcmpW
VirtualProtect
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
GetProcessHeap
InterlockedExchange
Sleep
InterlockedCompareExchange
GetStartupInfoA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
GetCurrentDirectoryA

advapi32

RegOpenKeyExW
RegQueryValueExA
RegQueryValueExW
RegOpenKeyExA
RegCloseKey

user32

GetSubMenu
GetMenu
IsWindowEnabled
GetLastActivePopup
GetForegroundWindow
RegisterClassA
CreateWindowExW
GetClassInfoA
GetClassInfoW
GetDlgCtrlID
GetTopWindow
AdjustWindowRectEx
SystemParametersInfoA
GetMonitorInfoA
MonitorFromWindow
RemovePropA
GetPropA
SetPropA
SetWindowLongW
GetWindowLongW
SetWindowsHookExA
CheckMenuItem
EnableMenuItem
GetMenuState
ModifyMenuA
GetNextDlgTabItem
GetCursorPos
ValidateRect
GetKeyState
DispatchMessageA
TranslateMessage
GetMessageA
IsWindowVisible
MessageBoxA
TranslateAcceleratorA
GetDesktopWindow
BringWindowToTop
LoadAcceleratorsA
DestroyMenu
LoadMenuA
WinHelpA
SetMenu
EndDialog
CreateDialogIndirectParamA
CreateDialogIndirectParamW
DialogBoxIndirectParamA
DialogBoxIndirectParamW
TabbedTextOutA
DrawTextA
GrayStringA
DrawTextW
ModifyMenuW
TabbedTextOutW
GetMenuItemID
GetClassNameA
SetWindowTextA
UnregisterClassA
UnregisterClassW
CopyRect
IsDialogMessageW
IsDialogMessageA
GetWindow
IsWindowUnicode
DefWindowProcA
CallWindowProcA
GetMessageTime
GetMessagePos
GetWindowLongA
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
LoadStringA
GetWindowTextLengthA
GetWindowTextW
GetWindowTextA
BeginDeferWindowPos
EndDeferWindowPos
DeferWindowPos
GetAsyncKeyState
SendDlgItemMessageA
DrawFocusRect
DrawIcon
CharPrevA
DestroyWindow
IsCharAlphaNumericA
CharNextA
GetDC
ReleaseDC
MapDialogRect
MessageBoxW
ShowWindow
LoadMenuW
GetSystemMetrics
PeekMessageA
CreateWindowExA
MessageBeep
IsWindow
SetCursor
SetForegroundWindow
GetFocus
SetWindowPos
IsIconic
SetWindowLongA
SetWindowTextW
ScreenToClient
GetDlgItem
SetFocus
EnableWindow
RedrawWindow
SendMessageA
GetClientRect
MoveWindow
GetWindowRect
OffsetRect
PostMessageA
SetRectEmpty
LoadStringW
LoadIconA
LoadCursorA
RegisterClassW
DefWindowProcW
PostQuitMessage
GetParent
GetWindowThreadProcessId
GetMenuItemCount
GetSysColor

gdi32

SaveDC
RestoreDC
SetBkColor
SetTextColor
SetMapMode
GetClipBox
DeleteObject
PtVisible
DeleteDC
TextOutA
ExtTextOutA
Escape
SelectObject
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
GetDeviceCaps
TextOutW
ExtTextOutW
PatBlt
GetTextMetricsA
CreateFontIndirectA
GetObjectA
RectVisible
GetStockObject
GetTextExtentPointW

Exports

Exports

_GetAllocCounters@0

Sections

.text
Size: 103KB - Virtual size: 103KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 38KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

bdb0cb030bcfd4cf1c0d39c87b189170

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88Certificate

Extended Key Usages

Key Usages

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:baCertificate

Extended Key Usages

Key Usages

61:46:9e:cb:00:04:00:00:00:65Certificate

Extended Key Usages

Key Usages

e5:67:a4:d4:63:42:8e:5b:0f:87:5c:0a:07:7f:4d:52:21:61:bc:f9Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcr80

shell32

ole32

kernel32

advapi32

user32

gdi32

Exports

Exports

Sections

.text Size: 103KB - Virtual size: 103KB

.data Size: 16KB - Virtual size: 20KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 38KB - Virtual size: 52KB

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

61:46:9e:cb:00:04:00:00:00:65
Certificate

e5:67:a4:d4:63:42:8e:5b:0f:87:5c:0a:07:7f:4d:52:21:61:bc:f9
Signer

.text
Size: 103KB - Virtual size: 103KB

.data
Size: 16KB - Virtual size: 20KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 38KB - Virtual size: 52KB