27be94866fcee3dbf7ef9a4900faebd1_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

27be94866fcee3dbf7ef9a4900faebd1_JaffaCakes118
Size

181KB
MD5

27be94866fcee3dbf7ef9a4900faebd1
SHA1

1e8e84282e12250376f53f7109932cf6920339f1
SHA256

6ff27a695388a0ec9093e0d9777282a0fb334a18aa0306c7fa5e857a8163dca1
SHA512

4b8419d5a422a8a1cae057560196c919f3b9955fe0f9f0352774540ed04513d98694a2a41c845b2c1247828c93b6bd6958d8c10141b16743c4d174895aa681bf
SSDEEP

3072:GLMN86g4nfym/2BFxTG7beAKtz2cGVELIjVatTAbw7kKkHkkkc:9NLVymeBrGb6tqcGmcEtTY

Score

1^/10

Malware Config

Signatures

Files

27be94866fcee3dbf7ef9a4900faebd1_JaffaCakes118
.dll windows:5 windows x86 arch:x86

426e06833845b37e39b02dd292e058ba

Code Sign

0b:93:e4:6a:43:e7:8f:58:b0:86:b5:15:ce:6f:eb:ab
Certificate

Issuer

CN=abme1mll1ajilgkjdbjbbj2i1cbmi3j2e22jl1d1jllbmke2caeahgkilgilcdgmfjmm1hibkk3djkmic2i2md1h22g2lajeldibfidecl2jjdjhe3emafb3jakdcdb2b1bf3jm3jbkdabbm1dccaj1kfiiladlah1mmj21ki1mi1h1ehdf3ejm32b2dlcjaaki3if313ghf2edmcgghciheildjgljch1k2ag1mdeg1kc132higmdj2hihfaf1hhdd3cfbmldlliddgfeimbe13gl3efagbdkjbl3g3e3c3jg1jd1ielm2lfl2k1jf2ae1femjgajacmfh3hffldkiagckdmfm1lfhhd3eafdc3lbl1g3ehmei1dlf2fe1kbdjgjfglmcmm3kdglfcdh2kaifjcdd13hg1lhfmdf11dkgk1dagcbf1ef3i3cf2gflechcced2lg2k1bb121d31db1ljjmfhh2jaajhh3cemhbidlkade2kggfhjkbgh3a32i3lddhad3ei22jmkgadeb3gdfjhmdfc33il3ca3amfjai2k2ikgchg11hfmjmafkc3iaa3j23bkd3bkcf2eg3gjhi2m3kkh1lkckil23j3kamjf3hh1aga1fmi13a1lmblk1h2ileag2mc1ga2dekgichchhghacg1blccjbjb3dbklmdbh3dlabghbghgmcjhjc2glgljeebdc21mkajidkdjegelmchjdaijagmjfei213ig3fkgjlgihbdmjdh2dbaaeckmeffb3lk3jhjbamdmec2aci3ml3l2me1jbgmge3hamc2ibgkjf2d2a1acbcd1cl1a2ggfbf2blldm11h1dleebfhmgdggmmm13b3mcilammkbmkdak3iabi32bhehhdlgfejlm1gjcigm3mffdlmbbe2jhdh3jeekejkd22g3edbhcj2kmbamkajf1ji3aiaeahmj2llch3i1g22g3aihai2jkkimd1ek1g3fl1d1b11lg131ki2j12lcdim2blcmamg3mbidlmhchailke32fmhlb3l1b2id2mjeclddkkcddg3hl31cfaiim2egfj3e2jedeghgidmfahee1fagbbagk2iggg33eejlddcb1bk3lad21mdlfm2agl13dfm1jmmckldcb2flidimmmfhjdmji13eh2fceajmjlcb2bjghkh3ikkbjaa3jk1lfmg1ml1dlifd2aj31heebjmc1dblfhk1gdjikklbd22elajhk31bjmiiddm3gkae33dghflf13k1begdeb3gae2ae1ajhdk2l3fglej1mchcl22k1bbbiagmaffcefll2la3c3f11hk3f2ee1ijfc1la2dcmi2imfbmgejejechmkdb1eihecilcbkidcmligech2hakabblkibe1ijjlmklcahb1lef23gmjkijfedk3mgjjgjj3cafcckgihg1dfhhddmcdghakgf3ch3febla2fiaaji2elefhbefaed2hajmmfmg2amlhegffjhejbf1dc1elgkbhc3idcbcbehjk2ehg1edbkaddbfb1hlbial2kgkieai3k1bccke2fdidfjbfgjb1k3ek1aac1g1ff2f1kdblf2meidlh3iec3ci1dehfcfjg3fhj3kjekbhhlh3eibjggjfjh1d3k1f2g1lcaaadhmbk1kaj11blcfccc23lmlmmaj21ce1hfe2c2beiagklediaaailcl3cma1leclaifab13gckc1133fmjaf3dhdfbbbhlhlakbdd1fg2bibbfgmcmfj3ihdl3b2hj2b3abc12eid3lkalbebcke3mdm11lflc2icfedccke1jagcdiiklcd2ibbi1ce2lamf33kllehimfcgebibag3cgfjki2gehjbfk2f312cd23ggbckmcf3adcac32b2111a1fa1kbmblghha2gemgdfjjhgmhifbamkf1ebgg3hmmiigikdaeliejbkchm1le1fkfgahelk1ifdmajijcc1cbjhm2jhbhfklehjabbgiik1gehdklaa22mh2hhljimc3ffghamfmb2e2ecga2ijilmiebm3mebih1l2begha1dbkkigabmjmcakdcj3dgelmg31g3cmh1lked1lfbi2kld2hh1gfj1m32f3m2eijkbldfk3gch1amflhcdhlff3j11ijcgcjba2dk1ab22k3llga2caba1i1bdghfiabilglihlmfb2f1mkkk2j3ajbgmbc2eladkgbjd1eg21cecgdc1ghbjaegjlbfhi1li3if1l1hhag2mmacdjgb1aakjdahgkj1lbmlka13dbgckccjb32m1jdhdji2jdffcdmij33g1fhejf13b1d1jcaifg1deghjbk3iiam1g1jghchhdhbc2g1dcdmck2ggggiifaf2fgjm13jj2m3hjcafgd1g2i1bceeflbiljmligc2hafakelegbgdkahhi22j1fhk2fda3ije1mmbkjieemklm3ceejjl3l1alfbbfkgm12ejfbgagei2hiegdjjekebc1keeab1heh2ikafkl3g1kj2a1kmm1ghkhmjjfaj1f1imkmke1hheckdjda3ehfghhjiikjjdmamldjbgl2jm1g2k1eijldlichgigmaead3gijhjamhgkdk3memaicf2ebggaig21ceijl2h1bk1jhlfmj2kacl3eiem3khak2mjh333lbgkjih112jdfafbbg12l1elgabhgbfb3hm1lijkmhjbjkb3cjhl21bdhfm3i3aadhkbajacl1ddajdefggmabja2ebf3cgclij2ika1gclfmjc3ekjdkclkchdlad32dk3dhkcfclamcajb2h3aiei2ea2kakk3bebm1gchlg3ihgi31g3kd1hj1j1ibmjba3m32kddihad2ad1chafg2g23aifl2dfib2m1allfjid2cffh3d11jd2elakccdlgb213acejlif11kd2kimf2e33ghm1kjjb3bigbkdeg3fbcfcemjdjmckkdhkchjgjdj1jjfemhhhbamfl233h2lkkml2kg1kfheg1llccchjefl12b1imaamkahmkdbcfamhhlil1dcfd2a3ekeahmjaaf2cmmimchj31i3b3lk3febeigbdgkbiii1kijhj 5123333

Not Before

19/12/2012, 13:34

Not After

31/12/2039, 23:59

Subject

CN=abme1mll1ajilgkjdbjbbj2i1cbmi3j2e22jl1d1jllbmke2caeahgkilgilcdgmfjmm1hibkk3djkmic2i2md1h22g2lajeldibfidecl2jjdjhe3emafb3jakdcdb2b1bf3jm3jbkdabbm1dccaj1kfiiladlah1mmj21ki1mi1h1ehdf3ejm32b2dlcjaaki3if313ghf2edmcgghciheildjgljch1k2ag1mdeg1kc132higmdj2hihfaf1hhdd3cfbmldlliddgfeimbe13gl3efagbdkjbl3g3e3c3jg1jd1ielm2lfl2k1jf2ae1femjgajacmfh3hffldkiagckdmfm1lfhhd3eafdc3lbl1g3ehmei1dlf2fe1kbdjgjfglmcmm3kdglfcdh2kaifjcdd13hg1lhfmdf11dkgk1dagcbf1ef3i3cf2gflechcced2lg2k1bb121d31db1ljjmfhh2jaajhh3cemhbidlkade2kggfhjkbgh3a32i3lddhad3ei22jmkgadeb3gdfjhmdfc33il3ca3amfjai2k2ikgchg11hfmjmafkc3iaa3j23bkd3bkcf2eg3gjhi2m3kkh1lkckil23j3kamjf3hh1aga1fmi13a1lmblk1h2ileag2mc1ga2dekgichchhghacg1blccjbjb3dbklmdbh3dlabghbghgmcjhjc2glgljeebdc21mkajidkdjegelmchjdaijagmjfei213ig3fkgjlgihbdmjdh2dbaaeckmeffb3lk3jhjbamdmec2aci3ml3l2me1jbgmge3hamc2ibgkjf2d2a1acbcd1cl1a2ggfbf2blldm11h1dleebfhmgdggmmm13b3mcilammkbmkdak3iabi32bhehhdlgfejlm1gjcigm3mffdlmbbe2jhdh3jeekejkd22g3edbhcj2kmbamkajf1ji3aiaeahmj2llch3i1g22g3aihai2jkkimd1ek1g3fl1d1b11lg131ki2j12lcdim2blcmamg3mbidlmhchailke32fmhlb3l1b2id2mjeclddkkcddg3hl31cfaiim2egfj3e2jedeghgidmfahee1fagbbagk2iggg33eejlddcb1bk3lad21mdlfm2agl13dfm1jmmckldcb2flidimmmfhjdmji13eh2fceajmjlcb2bjghkh3ikkbjaa3jk1lfmg1ml1dlifd2aj31heebjmc1dblfhk1gdjikklbd22elajhk31bjmiiddm3gkae33dghflf13k1begdeb3gae2ae1ajhdk2l3fglej1mchcl22k1bbbiagmaffcefll2la3c3f11hk3f2ee1ijfc1la2dcmi2imfbmgejejechmkdb1eihecilcbkidcmligech2hakabblkibe1ijjlmklcahb1lef23gmjkijfedk3mgjjgjj3cafcckgihg1dfhhddmcdghakgf3ch3febla2fiaaji2elefhbefaed2hajmmfmg2amlhegffjhejbf1dc1elgkbhc3idcbcbehjk2ehg1edbkaddbfb1hlbial2kgkieai3k1bccke2fdidfjbfgjb1k3ek1aac1g1ff2f1kdblf2meidlh3iec3ci1dehfcfjg3fhj3kjekbhhlh3eibjggjfjh1d3k1f2g1lcaaadhmbk1kaj11blcfccc23lmlmmaj21ce1hfe2c2beiagklediaaailcl3cma1leclaifab13gckc1133fmjaf3dhdfbbbhlhlakbdd1fg2bibbfgmcmfj3ihdl3b2hj2b3abc12eid3lkalbebcke3mdm11lflc2icfedccke1jagcdiiklcd2ibbi1ce2lamf33kllehimfcgebibag3cgfjki2gehjbfk2f312cd23ggbckmcf3adcac32b2111a1fa1kbmblghha2gemgdfjjhgmhifbamkf1ebgg3hmmiigikdaeliejbkchm1le1fkfgahelk1ifdmajijcc1cbjhm2jhbhfklehjabbgiik1gehdklaa22mh2hhljimc3ffghamfmb2e2ecga2ijilmiebm3mebih1l2begha1dbkkigabmjmcakdcj3dgelmg31g3cmh1lked1lfbi2kld2hh1gfj1m32f3m2eijkbldfk3gch1amflhcdhlff3j11ijcgcjba2dk1ab22k3llga2caba1i1bdghfiabilglihlmfb2f1mkkk2j3ajbgmbc2eladkgbjd1eg21cecgdc1ghbjaegjlbfhi1li3if1l1hhag2mmacdjgb1aakjdahgkj1lbmlka13dbgckccjb32m1jdhdji2jdffcdmij33g1fhejf13b1d1jcaifg1deghjbk3iiam1g1jghchhdhbc2g1dcdmck2ggggiifaf2fgjm13jj2m3hjcafgd1g2i1bceeflbiljmligc2hafakelegbgdkahhi22j1fhk2fda3ije1mmbkjieemklm3ceejjl3l1alfbbfkgm12ejfbgagei2hiegdjjekebc1keeab1heh2ikafkl3g1kj2a1kmm1ghkhmjjfaj1f1imkmke1hheckdjda3ehfghhjiikjjdmamldjbgl2jm1g2k1eijldlichgigmaead3gijhjamhgkdk3memaicf2ebggaig21ceijl2h1bk1jhlfmj2kacl3eiem3khak2mjh333lbgkjih112jdfafbbg12l1elgabhgbfb3hm1lijkmhjbjkb3cjhl21bdhfm3i3aadhkbajacl1ddajdefggmabja2ebf3cgclij2ika1gclfmjc3ekjdkclkchdlad32dk3dhkcfclamcajb2h3aiei2ea2kakk3bebm1gchlg3ihgi31g3kd1hj1j1ibmjba3m32kddihad2ad1chafg2g23aifl2dfib2m1allfjid2cffh3d11jd2elakccdlgb213acejlif11kd2kimf2e33ghm1kjjb3bigbkdeg3fbcfcemjdjmckkdhkchjgjdj1jjfemhhhbamfl233h2lkkml2kg1kfheg1llccchjefl12b1imaamkahmkdbcfamhhlil1dcfd2a3ekeahmjaaf2cmmimchj31i3b3lk3febeigbdgkbiii1kijhj 5123333

Extended Key Usages

ExtKeyUsageCodeSigning

67:39:df:c5:ca:3b:57:b6:d6:3a:58:d3:f9:58:3a:d9:25:df:f2:29
Signer

Actual PE Digest

67:39:df:c5:ca:3b:57:b6:d6:3a:58:d3:f9:58:3a:d9:25:df:f2:29

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleHandleA
ReadFile
VirtualAlloc
GetStartupInfoW
GetProcAddress

gdi32

GetStockObject

advapi32

RegQueryValueA

Sections

.text
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 318B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 120KB - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 544B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

426e06833845b37e39b02dd292e058ba

Code Sign

0b:93:e4:6a:43:e7:8f:58:b0:86:b5:15:ce:6f:eb:abCertificate

Extended Key Usages

67:39:df:c5:ca:3b:57:b6:d6:3a:58:d3:f9:58:3a:d9:25:df:f2:29Signer

Headers

File Characteristics

Imports

kernel32

gdi32

advapi32

Sections

.text Size: 12KB - Virtual size: 11KB

.rdata Size: 512B - Virtual size: 318B

.data Size: 120KB - Virtual size: 120KB

.rsrc Size: 27KB - Virtual size: 26KB

.reloc Size: 1024B - Virtual size: 544B

0b:93:e4:6a:43:e7:8f:58:b0:86:b5:15:ce:6f:eb:ab
Certificate

67:39:df:c5:ca:3b:57:b6:d6:3a:58:d3:f9:58:3a:d9:25:df:f2:29
Signer

.text
Size: 12KB - Virtual size: 11KB

.rdata
Size: 512B - Virtual size: 318B

.data
Size: 120KB - Virtual size: 120KB

.rsrc
Size: 27KB - Virtual size: 26KB

.reloc
Size: 1024B - Virtual size: 544B