26742adb220748b11155a1f44ccd02fa_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

26742adb220748b11155a1f44ccd02fa_JaffaCakes118
Size

272KB
MD5

26742adb220748b11155a1f44ccd02fa
SHA1

74c12c7e5bc03098925f084e79bf7406dd57b277
SHA256

6fd15c8034b1357114cd52a4a4691914d80d4a298f1fbec75af5ce149a1d01e6
SHA512

7404c80584094a8b7c107d1bf3492486ddd74edc037ec837d6abb539e33b14cbba4af973360b237209af0b56e87f60b27be841f84b5b1835ba791602a4f37a8c
SSDEEP

6144:1nxvBCitKxofjsAwQaEexmb+xn5z6Fv0m:1nxvBgxoreQX7bqn5z6Ft

Score

1^/10

Malware Config

Signatures

Files

26742adb220748b11155a1f44ccd02fa_JaffaCakes118
.dll windows:5 windows x86 arch:x86

d252c039b79c351cc7b599d81a7475a9

Code Sign

23:5d:a6:d5:62:45:27:ac:4d:78:92:49:64:c0:e4:70
Certificate

Issuer

CN=nHyf1yTMeGbZX4U

Not Before

13-04-2012 11:21

Not After

31-12-2039 23:59

Subject

CN=nHyf1yTMeGbZX4U

Extended Key Usages

ExtKeyUsageCodeSigning

61:f9:9c:3c:ac:46:4d:a5:e9:2e:d3:7a:44:c9:f6:69:a7:ec:11:e8
Signer

Actual PE Digest

61:f9:9c:3c:ac:46:4d:a5:e9:2e:d3:7a:44:c9:f6:69:a7:ec:11:e8

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

VirtualAllocEx
GetProcAddress
LoadLibraryA
DosDateTimeToFileTime
AddAtomW
AddConsoleAliasW
CallNamedPipeW
CancelDeviceWakeupRequest
CompareStringW
ContinueDebugEvent
CopyFileA
CopyFileExW
CopyFileW
CreateFiber
CreateFileW
CreateMailslotW
CreateNamedPipeA
CreateRemoteThread
CreateSemaphoreA
CreateSemaphoreW
CreateWaitableTimerW
DebugBreak
DeleteAtom
DeleteCriticalSection
DeleteTimerQueueEx
DisconnectNamedPipe
DnsHostnameToComputerNameA
DuplicateHandle
EndUpdateResourceW
EnterCriticalSection
EnumCalendarInfoW
EnumDateFormatsExA
EnumLanguageGroupLocalesA
EnumSystemCodePagesW
EnumTimeFormatsA
EnumUILanguagesW
EscapeCommFunction
ExpandEnvironmentStringsW
FillConsoleOutputAttribute
FindFirstChangeNotificationA
FindFirstChangeNotificationW
FindFirstVolumeMountPointA
FindFirstVolumeMountPointW
FindFirstVolumeW
FindNextChangeNotification
FindNextFileA
FindNextVolumeA
FindNextVolumeMountPointW
FindResourceA
FindResourceExA
FindResourceExW
FindResourceW
FlushInstructionCache
FreeLibraryAndExitThread
FreeUserPhysicalPages
GenerateConsoleCtrlEvent
GetAtomNameA
GetCalendarInfoW
GetCommMask
GetCommModemStatus
GetCommandLineA
GetCommandLineW
GetCompressedFileSizeW
GetComputerNameA
GetConsoleAliasExesA
GetConsoleAliasesLengthA
GetConsoleTitleA
GetCurrentThreadId
GetDefaultCommConfigW
GetEnvironmentStrings
GetEnvironmentStringsA
GetExitCodeThread
GetFileAttributesExW
GetHandleInformation
GetLocaleInfoA
GetNamedPipeHandleStateA
GetNamedPipeHandleStateW
GetNamedPipeInfo
GetNumberFormatW
GetNumberOfConsoleInputEvents
GetNumberOfConsoleMouseButtons
GetPriorityClass
GetPrivateProfileIntA
GetPrivateProfileSectionW
GetPrivateProfileStringW
GetPrivateProfileStructW
GetProcessAffinityMask
GetProcessShutdownParameters
GetProcessTimes
GetProfileIntA
GetProfileIntW
GetProfileStringW
GetShortPathNameA
GetStartupInfoA
GetStringTypeExW
GetStringTypeW
GetSystemDefaultUILanguage
GetSystemTimeAdjustment
GetThreadLocale
GetThreadPriorityBoost
GetUserDefaultLangID
GetWindowsDirectoryW
GlobalAddAtomA
GlobalAlloc
GlobalCompact
GlobalFindAtomA
GlobalFlags
GlobalGetAtomNameW
GlobalMemoryStatus
Heap32ListFirst
Heap32Next
HeapValidate
InitAtomTable
InitializeCriticalSectionAndSpinCount
InterlockedExchangeAdd
IsBadStringPtrW
IsProcessorFeaturePresent
LeaveCriticalSection
LoadLibraryExW
LoadResource
LocalAlloc
LocalCompact
LocalLock
MapViewOfFile
Module32First
MoveFileExA
MoveFileW
OpenSemaphoreA
OpenWaitableTimerA
PeekConsoleInputW
Process32First
Process32FirstW
Process32NextW
QueryPerformanceFrequency
QueueUserAPC
ReadConsoleInputW
ReadFileScatter
ReadProcessMemory
RemoveDirectoryW
ReplaceFileW
RtlZeroMemory
SetCommConfig
SetConsoleScreenBufferSize
SetCurrentDirectoryA
SetDefaultCommConfigA
SetEvent
SetFileApisToANSI
SetFileAttributesA
SetLastError
SetLocalTime
SetProcessAffinityMask
SetStdHandle
SetSystemPowerState
SetThreadLocale
SleepEx
SwitchToFiber
SwitchToThread
SystemTimeToFileTime
TlsGetValue
Toolhelp32ReadProcessMemory
TransactNamedPipe
TransmitCommChar
UnhandledExceptionFilter
UnlockFileEx
VerLanguageNameA
VirtualLock
VirtualProtect
VirtualUnlock
WaitForDebugEvent
WaitForMultipleObjects
WaitForMultipleObjectsEx
WaitForSingleObjectEx
WriteConsoleOutputAttribute
WritePrivateProfileStringA
WritePrivateProfileStructW
_lclose
_llseek
_lopen
_lread
lstrcat
lstrcatA
lstrcmp
lstrcmpA
lstrcmpi
lstrlen
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
RtlUnwind
IsDebuggerPresent

user32

EnableMenuItem
GetSystemMenu

oleaut32

BSTR_UserSize
BSTR_UserUnmarshal
ClearCustData
DispCallFunc
DispGetIDsOfNames
DispGetParam
BSTR_UserMarshal
GetActiveObject
GetAltMonthNames
LHashValOfNameSys
LHashValOfNameSysA
LPSAFEARRAY_Size
LPSAFEARRAY_UserFree
LPSAFEARRAY_UserMarshal
LoadTypeLibEx
OaBuildVersion
OleCreateFontIndirect
OleCreatePictureIndirect
OleCreatePropertyFrame
OleCreatePropertyFrameIndirect
OleIconToCursor
OleLoadPictureEx
OleLoadPictureFile
OleLoadPictureFileEx
OleLoadPicturePath
QueryPathOfRegTypeLi
RegisterActiveObject
RevokeActiveObject
SafeArrayAccessData
SafeArrayAllocDescriptorEx
SafeArrayCreateEx
SafeArrayCreateVector
SafeArrayDestroyData
SafeArrayGetDim
SafeArrayGetRecordInfo
SafeArrayGetVartype
SafeArrayPtrOfIndex
SafeArrayPutElement
SafeArrayRedim
SafeArraySetIID
SafeArraySetRecordInfo
SafeArrayUnlock
SysAllocString
SysAllocStringByteLen
SysAllocStringLen
SysFreeString
SysReAllocStringLen
SysStringByteLen
SysStringLen
SystemTimeToVariantTime
VARIANT_UserSize
VarAdd
VarAnd
VarBoolFromCy
VarBoolFromDate
VarBoolFromDec
VarBoolFromDisp
VarBoolFromI1
VarBoolFromR4
VarBoolFromR8
VarBoolFromStr
VarBoolFromUI1
VarBstrCat
VarBstrCmp
VarBstrFromCy
VarBstrFromDisp
VarBstrFromI1
VarBstrFromR4
VarBstrFromUI1
VarBstrFromUI2
VarCyCmp
VarCyCmpR8
VarCyFromBool
VarCyFromDate
VarCyFromDec
VarCyFromDisp
VarCyFromI1
VarCyFromR4
VarCyFromStr
VarCyFromUI1
VarCyInt
VarCyMul
VarCyRound
VarDateFromBool
VarDateFromCy
VarDateFromDec
VarDateFromDisp
VarDateFromI1
VarDateFromI2
VarDateFromR4
VarDateFromUI2
VarDateFromUI4
VarDateFromUdate
VarDateFromUdateEx
VarDecAdd
VarDecCmp
VarDecDiv
VarDecFix
VarDecFromDisp
VarDecFromI4
VarDecFromR4
VarDecFromStr
VarDecFromUI1
VarDecFromUI2
VarDecInt
VarDecNeg
VarDiv
VarEqv
VarFix
VarFormatCurrency
VarFormatFromTokens
VarI1FromBool
VarI1FromCy
VarI1FromDate
VarI1FromDec
VarI1FromI4
VarI1FromR4
VarI1FromR8
VarI1FromStr
VarI1FromUI1
VarI2FromCy
VarI2FromDate
VarI2FromDec
VarI2FromDisp
VarI2FromI4
VarI2FromR4
VarI2FromR8
VarI2FromStr
VarI2FromUI1
VarI2FromUI2
VarI2FromUI4
VarI4FromCy
VarI4FromDate
VarI4FromDec
VarI4FromDisp
VarI4FromI2
VarI4FromR8
VarI4FromUI1
VarI4FromUI2
VarI4FromUI4
VarIdiv
VarMonthName
VarMul
VarNeg
VarPow
VarR4CmpR8
VarR4FromDate
VarR4FromDec
VarR4FromI4
VarR4FromR8
VarR4FromStr
VarR4FromUI1
VarR4FromUI2
VarR8FromBool
VarR8FromCy
VarR8FromDate
VarR8FromDec
VarR8FromDisp
VarR8FromI1
VarR8FromI4
VarR8FromStr
VarR8FromUI4
VarR8Pow
VarSu
VarTokenizeFormatString
VarUI1FromCy
VarUI1FromDate
VarUI1FromDec
VarUI1FromDisp
VarUI1FromI4
VarUI1FromR8
VarUI1FromStr
VarUI1FromUI4
VarUI2FromBool
VarUI2FromDate
VarUI2FromDisp
VarUI2FromI1
VarUI2FromI4
VarUI2FromR4
VarUI2FromR8
VarUI2FromStr
VarUI2FromUI1
VarUI4FromBool
VarUI4FromCy
VarUI4FromDate
VarUI4FromI1
VarUI4FromI4
VarUI4FromStr
VarUI4FromUI1
VarUI4FromUI2
VarXor
VariantChangeTypeEx
VariantCopyInd
VariantInit
VariantTimeToDosDateTime
VariantTimeToSystemTime
VectorFromBstr
BSTR_UserFree
DosDateTimeToVariantTime

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 253KB - Virtual size: 254KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data3
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d252c039b79c351cc7b599d81a7475a9

Code Sign

23:5d:a6:d5:62:45:27:ac:4d:78:92:49:64:c0:e4:70Certificate

Extended Key Usages

61:f9:9c:3c:ac:46:4d:a5:e9:2e:d3:7a:44:c9:f6:69:a7:ec:11:e8Signer

Headers

File Characteristics

Imports

kernel32

user32

oleaut32

Sections

.text Size: 5KB - Virtual size: 4KB

.rdata Size: 7KB - Virtual size: 7KB

.data Size: 253KB - Virtual size: 254KB

.data3 Size: 1024B - Virtual size: 1000B

.CRT Size: 512B - Virtual size: 4B

.reloc Size: 3KB - Virtual size: 2KB

23:5d:a6:d5:62:45:27:ac:4d:78:92:49:64:c0:e4:70
Certificate

61:f9:9c:3c:ac:46:4d:a5:e9:2e:d3:7a:44:c9:f6:69:a7:ec:11:e8
Signer

.text
Size: 5KB - Virtual size: 4KB

.rdata
Size: 7KB - Virtual size: 7KB

.data
Size: 253KB - Virtual size: 254KB

.data3
Size: 1024B - Virtual size: 1000B

.CRT
Size: 512B - Virtual size: 4B

.reloc
Size: 3KB - Virtual size: 2KB