2780883227f320c6c9b4fecf8f8f23ed_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

2780883227f320c6c9b4fecf8f8f23ed_JaffaCakes118
Size

746KB
MD5

2780883227f320c6c9b4fecf8f8f23ed
SHA1

a98d03db1ff5f6d6c0a56c2b94af03904cace4c3
SHA256

77e2a6f1e547bf5aafbbd7c133d3a327c3c56cfe471af9da8b29537695f9c0f9
SHA512

8dba054a9da03992fb334ee2d0cacaa36c0d99f8e2c40ff9c5cb5694c8ea641e84908ac9992870a4195acbef4834a18437d9a8b462347ef0108bafb9b0995cd9
SSDEEP

12288:L5HiA2A1mTeeaE55VqneduHTM8upLbgkTFbRa+zF:VHn1mTeeaqvcedGM8upLbgkTK+zF

Score

1^/10

Malware Config

Signatures

Files

2780883227f320c6c9b4fecf8f8f23ed_JaffaCakes118
.exe .vbs windows:5 windows x86 arch:x86 polyglot

63552784f1df2d8a60108b001d324574

Code Sign

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

61:47:52:ba:00:00:00:00:00:04
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:53

Not After

16/09/2011, 02:03

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:49:7c:ed:00:00:00:00:00:05
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:55

Not After

16/09/2011, 02:05

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:10D8-5847-CBF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

04/04/2006, 17:44

Not After

26/04/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:46:9e:cb:00:04:00:00:00:65
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/04/2006, 19:43

Not After

04/10/2007, 19:53

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

0c:cf:d8:12:5e:26:aa:be:5b:03:33:0d:5d:62:5d:22:3f:77:92:2a
Signer

Actual PE Digest

0c:cf:d8:12:5e:26:aa:be:5b:03:33:0d:5d:62:5d:22:3f:77:92:2a

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP

PDB Paths

D:\binaries.x86fre\SCP_WPA\update.PDB

Imports

advapi32

GetLengthSid
RegQueryValueExA
RegCloseKey
RegSetValueExA
RegCreateKeyExA
RegDeleteKeyA
RegEnumKeyExA
FreeSid
RegSetKeySecurity
EnumServicesStatusExA
OpenServiceW
InitiateSystemShutdownA
AbortSystemShutdownA
RegOpenKeyExW
GetFileSecurityA
LockServiceDatabase
QueryServiceConfigA
ChangeServiceConfigA
UnlockServiceDatabase
GetNamedSecurityInfoA
SetNamedSecurityInfoA
GetTokenInformation
RegisterEventSourceA
ReportEventA
DeregisterEventSource
SetSecurityDescriptorOwner
SetSecurityDescriptorDacl
OpenProcessToken
RegLoadKeyA
RegUnLoadKeyA
AdjustTokenPrivileges
RegCreateKeyExW
RegQueryValueExW
RegSetValueExW
RegOpenKeyExA
CopySid
GetAclInformation
SetFileSecurityW
AddAce
RegQueryInfoKeyA
RegSaveKeyA
RegFlushKey
EnumDependentServicesA
InitializeAcl
AddAccessAllowedAce
SetFileSecurityA
QueryServiceStatus
GetServiceDisplayNameA
RegOpenKeyA
RegDeleteValueA
OpenSCManagerA
OpenServiceA
StartServiceA
ControlService
CloseServiceHandle
AllocateAndInitializeSid
InitializeSecurityDescriptor

comctl32

PropertySheetW
CreatePropertySheetPageW

crypt32

CertSetCertificateContextProperty
CertOpenStore
CertCloseStore
CertFreeCertificateContext
CertCreateCertificateContext
CertAddCertificateContextToStore
CryptEncodeObject

gdi32

GetDeviceCaps
CreateFontIndirectA
DeleteObject
CreateCompatibleDC
GetDIBits
SelectObject
StretchBlt
BitBlt

imagehlp

EnumerateLoadedModules64

kernel32

VirtualAllocEx
CreateRemoteThread
OpenProcess
InterlockedIncrement
GetFullPathNameW
GetFileSizeEx
OpenEventA
CompareStringA
SearchPathA
GetLocalTime
lstrlenW
GetDriveTypeW
lstrcpynW
lstrcpyW
SearchPathW
ExpandEnvironmentStringsW
GetVersionExW
GetTempFileNameW
CopyFileW
ReleaseMutex
GetModuleFileNameW
GetSystemDefaultLangID
DuplicateHandle
CreateProcessW
OpenFileMappingA
RaiseException
GlobalFree
GlobalUnlock
GlobalHandle
GlobalLock
GlobalAlloc
FreeLibrary
DeleteFileA
GetWindowsDirectoryA
GetLastError
GetProcAddress
LoadLibraryA
GetSystemDirectoryW
CreateDirectoryA
GetFileAttributesA
FormatMessageA
lstrcmpiA
HeapDestroy
MultiByteToWideChar
FindClose
FindNextFileA
FindFirstFileA
ExpandEnvironmentStringsA
GetDriveTypeA
CloseHandle
UnmapViewOfFile
HeapCreate
CreateFileMappingA
GetFileSize
CreateFileA
SetLastError
LocalFree
LocalAlloc
GetVersionExA
SetFileAttributesA
MoveFileExA
CopyFileA
GetTempFileNameA
GetSystemDirectoryA
InterlockedCompareExchange
HeapFree
WriteFile
SetFilePointer
HeapAlloc
GetProcessHeap
WriteProcessMemory
GetLocaleInfoA
GetThreadLocale
Sleep
InitializeCriticalSection
GetEnvironmentVariableA
VirtualAlloc
GetModuleFileNameA
SetCurrentDirectoryA
WritePrivateProfileStringA
VirtualFree
GetFileAttributesExA
DeviceIoControl
FileTimeToSystemTime
FileTimeToLocalFileTime
LeaveCriticalSection
EnterCriticalSection
RemoveDirectoryA
SetEvent
WaitForMultipleObjects
SetThreadPriority
CreateThread
CreateEventA
GetTickCount
ReadFile
FormatMessageW
GetModuleHandleA
FileTimeToDosDateTime
GetFileInformationByHandle
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
WaitForSingleObject
CreateMutexA
GetCommandLineW
GetCommandLineA
SetErrorMode
GetVolumeInformationW
GetWindowsDirectoryW
lstrcmpA
GetVolumeInformationA
GetFullPathNameA
ExitProcess
SetUnhandledExceptionFilter
SetEnvironmentVariableA
GetSystemInfo
lstrlenA
FreeResource
LockResource
LoadResource
FindResourceA
LoadLibraryExA
GetTempPathA
GetCurrentProcess
GetDiskFreeSpaceExA
GetDiskFreeSpaceA
GetCompressedFileSizeA
GetComputerNameA
ReleaseSemaphore
SetEndOfFile
InterlockedDecrement
GetCurrentThread
GetExitCodeThread
CreateSemaphoreA
MoveFileA
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
GetStartupInfoA
CreateEventW
QueryDosDeviceA
DefineDosDeviceA
lstrcpynA
LoadLibraryW
FindFirstFileW
lstrcmpiW
GetPrivateProfileStringA
FindNextFileW
MapViewOfFileEx
CreateProcessA
GetExitCodeProcess
FlushFileBuffers
FlushViewOfFile
CreateFileW
DeleteFileW
GetFileTime
DelayLoadFailureHook
WideCharToMultiByte
MapViewOfFile
GetVersion
InitializeCriticalSectionAndSpinCount
VirtualProtect
GetSystemTime
TlsSetValue
TlsGetValue
TlsAlloc
TlsFree
DeleteCriticalSection

mpr

WNetGetUniversalNameA
WNetGetUserA

msvcrt

_initterm
__getmainargs
_acmdln
exit
_cexit
_XcptFilter
_exit
_c_exit
realloc
atoi
_memicmp
_local_unwind2
wcstoul
wcsstr
rename
_wcsicmp
ctime
_vsnwprintf
wcscat
_tempnam
remove
_lseek
_close
_write
_read
_open
_errno
_wcsdup
strncat
vsprintf
memmove
strncmp
_mbsupr
strcspn
isdigit
wcsrchr
wcscmp
wcsncat
wcsncpy
toupper
strspn
atol
__setusermatherr
isspace
_ultoa
_wtoi64
_wcslwr
strtok
_itow
?what@exception@@UBEPBDXZ
??1exception@@UAE@XZ
??0exception@@QAE@ABQBD@Z
__CxxFrameHandler
??3@YAXPAX@Z
??0exception@@QAE@ABV0@@Z
_CxxThrowException
fclose
??2@YAPAXI@Z
fopen
fprintf
wcschr
_ltoa
??1type_info@@UAE@XZ
?terminate@@YAXXZ
strtoul
getenv
calloc
_strdup
strstr
_mbslwr
_strcmpi
memchr
_strnicmp
wcslen
swprintf
wcscpy
_snwprintf
_snprintf
_itoa
strncpy
__set_app_type
_controlfp
_adjust_fdiv
__p__fmode
_except_handler3
strchr
__p__commode
_stricmp
sprintf
strrchr
mbstowcs
malloc
free
strpbrk
_vsnprintf

ntdll

RtlTimeToTimeFields
NtQuerySystemTime
RtlFreeUnicodeString
RtlInitUnicodeString
NtClose
NtAdjustPrivilegesToken
NtOpenProcessToken
NtQueryInformationProcess
RtlCharToInteger
LdrAccessResource
LdrFindResource_U
NtQuerySystemInformation
NtShutdownSystem
RtlRaiseStatus
RtlFreeHeap
RtlAllocateHeap
RtlCreateUnicodeString
NtYieldExecution
NtSetSystemInformation
NtCreateSection
NtOpenFile
NtOpenSection
NtOpenDirectoryObject
RtlCompareUnicodeString
NtCreateFile
RtlDosPathNameToNtPathName_U
LdrUnloadDll
NtFreeVirtualMemory
NtQueryInformationThread
NtWaitForSingleObject
RtlCreateUserThread
NtWriteVirtualMemory
NtAllocateVirtualMemory
RtlEqualUnicodeString
NtOpenProcess
LdrGetProcedureAddress
LdrLoadDll
RtlDestroyHeap
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
RtlGetAce
RtlAddAccessAllowedAce
RtlCreateAcl
RtlLengthSid
RtlAllocateAndInitializeSid
RtlCreateHeap
DbgPrint
RtlUnicodeStringToAnsiString
RtlFreeAnsiString
RtlInitAnsiString
RtlAnsiStringToUnicodeString

ole32

CoCreateInstance
CoUninitialize
CoInitialize
CoInitializeEx

oleaut32

SysFreeString

psapi

GetModuleFileNameExA

rpcrt4

UuidFromStringA

shell32

SHGetSpecialFolderPathA
SHChangeNotify
SHGetMalloc
SHGetPathFromIDListA
SHBrowseForFolderA

shlwapi

PathGetArgsA
PathUnquoteSpacesA

updspapi

UpdSpFindFirstLineW
UpdSpGetMultiSzFieldW
UpdSpGetTargetPathW
UpdSpStringTableEnum
UpdSpStringTableDestroy
UpdSpStringTableInitialize
UpdSpStringTableInitializeEx
UpdSpStringTableAddString
UpdSpStringTableAddStringEx
UpdSpStringTableLookUpString
UpdSpStringTableLookUpStringEx
UpdSpSetDynamicStringA
UpdSpCopyErrorA
UpdSpPromptForDiskA
UpdSpInitDefaultQueueCallbackEx
UpdSpIterateCabinetA
UpdSpGetLineCountW
UpdSpGetLineByIndexW
UpdSpGetStringFieldW
UpdSpCommitFileQueueA
UpdSpOpenFileQueue
UpdSpGetSourceInfoA
UpdSpGetSourceFileLocationA
UpdSpCloseFileQueue
UpdSpDefaultQueueCallbackW
UpdSpDefaultQueueCallbackA
UpdSpDecompressOrCopyFileA
UpdSpGetTargetPathA
UpdSpInstallFromInfSectionA
UpdSpQueueCopyA
UpdSpGetIntField
UpdSpGetBinaryField
UpdSpScanFileQueueA
UpdSpGetLineTextW
UpdSpOpenInfFileA
UpdSpCloseInfFile
UpdSpSetDirectoryIdA
UpdSpInstallFilesFromInfSectionA
UpdSpGetLineByIndexA
UpdSpGetStringFieldA
UpdSpFindFirstLineA
UpdSpGetLineTextA
UpdSpGetFieldCount
UpdSpFindNextLine
UpdSpGetLineCountA
UpdSpFindNextMatchLineW

user32

GetMessageA
PostThreadMessageA
DispatchMessageA
GetDlgItem
SetWindowTextW
RedrawWindow
SetWindowLongA
MessageBoxA
LoadStringW
GetWindowLongA
GetWindowTextA
OpenWindowStationA
EnumWindowStationsA
wvsprintfW
LoadStringA
GetSystemMetrics
MessageBoxW
DefWindowProcA
CreateWindowExA
RegisterClassA
GetWindow
PostMessageA
EnumChildWindows
SetDlgItemTextW
GetWindowThreadProcessId
FindWindowExA
GetClientRect
CloseDesktop
EnumWindows
SetThreadDesktop
GetThreadDesktop
OpenDesktopA
CloseWindowStation
EnumDesktopsA
SetProcessWindowStation
LoadBitmapA
IsDlgButtonChecked
SetTimer
CheckDlgButton
KillTimer
ReleaseDC
GetDC
SetFocus
GetDesktopWindow
DialogBoxParamA
EndDialog
SetWindowTextA
SetForegroundWindow
TranslateMessage
SystemParametersInfoA
EnableWindow
ShowWindow
SetDlgItemTextA
SendMessageA
DestroyWindow
PostQuitMessage
GetProcessWindowStation

version

VerQueryValueA
GetFileVersionInfoSizeA
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
GetFileVersionInfoA

winspool.drv

GetPrinterDriverDirectoryA

Sections

.text
Size: 607KB - Virtual size: 607KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 4KB - Virtual size: 503KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 124KB - Virtual size: 123KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.zwt
Size: - Virtual size: 1B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

63552784f1df2d8a60108b001d324574

Code Sign

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate

61:47:52:ba:00:00:00:00:00:04Certificate

Extended Key Usages

Key Usages

61:49:7c:ed:00:00:00:00:00:05Certificate

Extended Key Usages

Key Usages

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2Certificate

Extended Key Usages

Key Usages

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:baCertificate

Extended Key Usages

Key Usages

61:46:9e:cb:00:04:00:00:00:65Certificate

Extended Key Usages

Key Usages

0c:cf:d8:12:5e:26:aa:be:5b:03:33:0d:5d:62:5d:22:3f:77:92:2aSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

comctl32

crypt32

gdi32

imagehlp

kernel32

mpr

msvcrt

ntdll

ole32

oleaut32

psapi

rpcrt4

shell32

shlwapi

updspapi

user32

version

winspool.drv

Sections

.text Size: 607KB - Virtual size: 607KB

.data Size: 4KB - Virtual size: 503KB

.rsrc Size: 124KB - Virtual size: 123KB

.zwt Size: - Virtual size: 1B

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

61:47:52:ba:00:00:00:00:00:04
Certificate

61:49:7c:ed:00:00:00:00:00:05
Certificate

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba
Certificate

61:46:9e:cb:00:04:00:00:00:65
Certificate

0c:cf:d8:12:5e:26:aa:be:5b:03:33:0d:5d:62:5d:22:3f:77:92:2a
Signer

.text
Size: 607KB - Virtual size: 607KB

.data
Size: 4KB - Virtual size: 503KB

.rsrc
Size: 124KB - Virtual size: 123KB

.zwt
Size: - Virtual size: 1B