16a584092e7d8c4652a8e8bb6560390c_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

16a584092e7d8c4652a8e8bb6560390c_JaffaCakes118
Size

602KB
MD5

16a584092e7d8c4652a8e8bb6560390c
SHA1

143ea866170c0feda8d37c4378b74df7ef534cb6
SHA256

67ad6544dfef612b75a7fb2f8e08cf620cf94c5e5f2e44b835b1e9e60eb56343
SHA512

b8299e46daf9d28a1f77fc761a6009570721f1bfe0d54b0427d65159b4a1150f18e7338b8d074ff33145a0dbd2d62b327fc88c53079e9290c8f7db4ef5a8ca3a
SSDEEP

12288:MEqYNUcf7lbAGiiQ+NrSile+W9o2Ff3163uhjWjQzw:ME5Ucf7lbAGiiRNmH+gR91JjWkzw

Score

1^/10

Malware Config

Signatures

Files

16a584092e7d8c4652a8e8bb6560390c_JaffaCakes118
.dll regsvr32 windows:5 windows x86 arch:x86

2eb912bb8809e2f66fd4b18b8393d562

Code Sign

3d:0c:9c:cf:6a:7d:44:b9:fd:a1:96:3a:42:43:19:ba
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

29/08/2012, 00:00

Not After

29/08/2013, 23:59

Subject

CN=Awesome Apps,O=Awesome Apps,L=Philadelphia,ST=Pennsylvania,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

17/11/2006, 00:00

Not After

16/07/2036, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:16:e3:fc:22:5f:8a:98:04:fd:7e:56:41:9e:46:39:95:4d:d9:7b
Signer

Actual PE Digest

65:16:e3:fc:22:5f:8a:98:04:fd:7e:56:41:9e:46:39:95:4d:d9:7b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

oleacc

AccessibleObjectFromWindow

urlmon

CoInternetGetSession
URLDownloadToCacheFileA

wininet

InternetSetOptionA
InternetOpenA
InternetReadFile
InternetGetCookieA
InternetSetCookieA
HttpSendRequestA
HttpQueryInfoA
InternetCloseHandle
InternetConnectA
InternetCrackUrlA
HttpOpenRequestA

ws2_32

WSACleanup
gethostbyname
WSAStartup
inet_ntoa

kernel32

FreeLibrary
LoadLibraryA
CloseHandle
GetLastError
GetCurrentProcess
OpenProcess
Sleep
TerminateProcess
WaitForSingleObject
CreateThread
RaiseException
EnterCriticalSection
LeaveCriticalSection
FlushInstructionCache
SetLastError
WideCharToMultiByte
LocalFree
FormatMessageA
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
MultiByteToWideChar
UnmapViewOfFile
SetEvent
MapViewOfFile
OpenFileMappingA
CreateFileMappingA
CreateEventA
lstrcpyA
LocalAlloc
InitializeCriticalSection
WriteFile
ReadFile
SetFilePointer
GetFileSize
CreateFileA
lstrlenW
ReleaseMutex
lstrcmpiA
DisableThreadLibraryCalls
GetModuleFileNameA
GetModuleHandleW
IsDBCSLeadByte
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
GetCurrentProcessId
CreateMutexA
FindClose
FindNextFileA
lstrlenA
GetVersion
ExpandEnvironmentStringsA
GetFileType
SetHandleCount
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetTimeZoneInformation
HeapDestroy
HeapCreate
GetLocaleInfoW
GetModuleFileNameW
GetStdHandle
ExitProcess
HeapSize
GetStringTypeW
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
LCMapStringW
GetCommandLineA
VirtualQuery
GetSystemInfo
VirtualProtect
HeapReAlloc
GetLocalTime
GetSystemTimeAsFileTime
RtlUnwind
DecodePointer
EncodePointer
InterlockedExchange
InterlockedPopEntrySList
VirtualAlloc
GetCurrentThreadId
OutputDebugStringA
DebugBreak
InterlockedIncrement
OpenMutexA
InterlockedDecrement
GetModuleHandleA
GetProcAddress
GetStartupInfoW
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
LoadLibraryW
SetStdHandle
WriteConsoleW
CreateFileW
LCMapStringA
SetEndOfFile
VirtualFree
IsProcessorFeaturePresent
HeapAlloc
GetProcessHeap
HeapFree
InterlockedPushEntrySList
InterlockedCompareExchange
CompareStringW
SetEnvironmentVariableA
GetStringTypeExA
FindFirstFileA

user32

CharNextA
PostMessageA
GetWindowThreadProcessId
EnumWindows
SetWindowLongA
GetClassInfoExA
LoadCursorA
DefWindowProcA
RegisterClassExA
CreateWindowExA
GetWindowLongA
CallWindowProcA
DestroyWindow
GetDesktopWindow
DestroyIcon
SendMessageA
GetWindowRect
LoadStringA
SetWindowPos
GetParent
FindWindowExA
UnhookWindowsHookEx
SetTimer
KillTimer
CharNextW
MessageBoxA
CharLowerA
GetWindowTextA
IsWindowVisible
wvsprintfA
UnregisterClassA

advapi32

RegQueryInfoKeyA
RegCreateKeyExA
RegDeleteValueA
RegCloseKey
RegQueryValueExA
RegSetValueExA
RegEnumValueA
RegEnumKeyExA
RegQueryInfoKeyW
RegDeleteKeyA
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyExA

shell32

ShellExecuteExA
ShellExecuteA
SHGetFolderPathA

ole32

CoTaskMemFree
CoGetClassObject
CLSIDFromProgID
CoTaskMemAlloc
CoTaskMemRealloc
CoCreateGuid
StringFromGUID2
CoCreateInstance

oleaut32

SysAllocString
SysFreeString
SysStringLen
VariantInit
VariantClear
DispCallFunc
LoadTypeLi
UnRegisterTypeLi
RegisterTypeLi
VarUI4FromStr
LoadRegTypeLi
SysAllocStringLen
VariantChangeType
VariantCopy

gdiplus

GdiplusShutdown

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 420KB - Virtual size: 420KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 108KB - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2eb912bb8809e2f66fd4b18b8393d562

Code Sign

3d:0c:9c:cf:6a:7d:44:b9:fd:a1:96:3a:42:43:19:baCertificate

Extended Key Usages

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5eCertificate

Extended Key Usages

Key Usages

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6dCertificate

Key Usages

65:16:e3:fc:22:5f:8a:98:04:fd:7e:56:41:9e:46:39:95:4d:d9:7bSigner

Headers

DLL Characteristics

File Characteristics

Imports

oleacc

urlmon

wininet

ws2_32

kernel32

user32

advapi32

shell32

ole32

oleaut32

gdiplus

Exports

Exports

Sections

.text Size: 420KB - Virtual size: 420KB

.rdata Size: 108KB - Virtual size: 107KB

.data Size: 15KB - Virtual size: 24KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 12KB - Virtual size: 12KB

.reloc Size: 41KB - Virtual size: 40KB

3d:0c:9c:cf:6a:7d:44:b9:fd:a1:96:3a:42:43:19:ba
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d
Certificate

65:16:e3:fc:22:5f:8a:98:04:fd:7e:56:41:9e:46:39:95:4d:d9:7b
Signer

.text
Size: 420KB - Virtual size: 420KB

.rdata
Size: 108KB - Virtual size: 107KB

.data
Size: 15KB - Virtual size: 24KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 12KB - Virtual size: 12KB

.reloc
Size: 41KB - Virtual size: 40KB