2733c79a323d743f146f394b385319f8_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

2733c79a323d743f146f394b385319f8_JaffaCakes118
Size

125KB
MD5

2733c79a323d743f146f394b385319f8
SHA1

c97d13ec0ef2c3484a7fee92c04d528cdf7bc406
SHA256

eb777c15ff05cfba082719700c78836335b7c8749f7ade34d55acdd3c37582b6
SHA512

bf38fed638f93e5324584ef9b45d6d748d9d869a6fbdc4d3a8b671764d90ea8851ddcc7ddd9985326bc514267b10ecd38fd322ddb9b2139dcf169e06c6fce4a8
SSDEEP

3072:99tDIzggsSdHD3pC6WwgyHP5YUxzKV10RbuWIm:t0zVHdjIRixzKoRbuZm

Score

1^/10

Malware Config

Signatures

Files

2733c79a323d743f146f394b385319f8_JaffaCakes118
.exe windows:2 windows x86 arch:x86

facece26bf20fc71965d53373c88f5ab

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:94:d7:39:bc:82:c7:14:9e:be:00:e2:c8:d7:be:f6
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

18/05/2010, 00:00

Not After

16/02/2011, 23:59

Subject

CN=Trend Micro\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=RD,O=Trend Micro\, Inc.,L=Taipei,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

42:23:4a:89:49:e3:4c:a4:ad:46:52:34:60:7c:0d:3d:6e:91:09:ee
Signer

Actual PE Digest

42:23:4a:89:49:e3:4c:a4:ad:46:52:34:60:7c:0d:3d:6e:91:09:ee

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetStartupInfoW
CreateNamedPipeA
GetVersionExA
IsDebuggerPresent
VirtualAlloc
lstrcpynA
LocalAlloc
GetLongPathNameA
MoveFileW
InitializeCriticalSection
GetLogicalDriveStringsA
GetNumberFormatW
TlsAlloc
GetExpandedNameW
GetEnvironmentVariableW
GetSystemDirectoryA
CreatePipe
QueryPerformanceCounter
lstrcat
ExpandEnvironmentStringsW
CreateFiber
Beep
OpenFile
RemoveDirectoryW
EnumDateFormatsW
BeginUpdateResourceW
SetCalendarInfoW
GetFullPathNameA
SetCurrentDirectoryA
EnumTimeFormatsA
GetAtomNameA
GetDiskFreeSpaceW
OpenSemaphoreW

user32

SetWindowLongA
CreateIcon
GetForegroundWindow
UpdateLayeredWindow
GetClassNameW
CreateWindowExW
GetCursorPos
EnumChildWindows
RegisterClassA
GetMenuItemInfoW
UnregisterClassA
DestroyWindow
FillRect
CloseWindow
GetClassLongA
GetDC
ClientToScreen
SetTimer
CreateDialogIndirectParamA
DefWindowProcA
BringWindowToTop
InsertMenuItemA
MessageBeep
ReleaseDC
DestroyMenu
CheckMenuItem
CharNextW
ShowCaret
DrawIcon

gdi32

SetStretchBltMode
FillRgn
ResetDCW
StretchDIBits
GetEnhMetaFileDescriptionW
DeleteColorSpace
GetCharacterPlacementW
SetPixel
PolyPolygon
SetLayout
ExtTextOutA
GetFontData
EqualRgn
GetEnhMetaFileBits
PlayMetaFile
EnumFontsA
GetMetaRgn
CreateRoundRectRgn
SelectPalette

advapi32

LsaOpenPolicy
RegCreateKeyW
RegOpenKeyExA

shell32

SHGetDataFromIDListA
ExtractIconEx
ShellExecuteExW

shlwapi

PathSetDlgItemPathA
PathUndecorateA
PathStripPathW
SHCreateThread

comctl32

CreatePropertySheetPage

comdlg32

PrintDlgW

ole32

CoFreeLibrary
CoGetCurrentProcess
OleCreateEx

oleaut32

VarUI2FromUI1
VarUI4FromR8

version

VerFindFileW

ws2_32

WSAGetLastError
select
getservbyport
connect
WSAIoctl
WSAEventSelect
WSASend
WSAEnumProtocolsA

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.18t
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gdIgx4
Size: - Virtual size: 1KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.9346X3
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.9X712
Size: - Virtual size: 3KB

IMAGE_SCN_MEM_READ

.V
Size: 3KB - Virtual size: 88KB

IMAGE_SCN_MEM_READ

.rsrc
Size: 97KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

facece26bf20fc71965d53373c88f5ab

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

04:94:d7:39:bc:82:c7:14:9e:be:00:e2:c8:d7:be:f6Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

42:23:4a:89:49:e3:4c:a4:ad:46:52:34:60:7c:0d:3d:6e:91:09:eeSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

shlwapi

comctl32

comdlg32

ole32

oleaut32

version

ws2_32

Sections

.text Size: 7KB - Virtual size: 7KB

.18t Size: 3KB - Virtual size: 3KB

.gdIgx4 Size: - Virtual size: 1KB

.9346X3 Size: 1KB - Virtual size: 1KB

.rdata Size: 3KB - Virtual size: 3KB

.9X712 Size: - Virtual size: 3KB

.V Size: 3KB - Virtual size: 88KB

.rsrc Size: 97KB - Virtual size: 96KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

04:94:d7:39:bc:82:c7:14:9e:be:00:e2:c8:d7:be:f6
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

42:23:4a:89:49:e3:4c:a4:ad:46:52:34:60:7c:0d:3d:6e:91:09:ee
Signer

.text
Size: 7KB - Virtual size: 7KB

.18t
Size: 3KB - Virtual size: 3KB

.gdIgx4
Size: - Virtual size: 1KB

.9346X3
Size: 1KB - Virtual size: 1KB

.rdata
Size: 3KB - Virtual size: 3KB

.9X712
Size: - Virtual size: 3KB

.V
Size: 3KB - Virtual size: 88KB

.rsrc
Size: 97KB - Virtual size: 96KB