2a64c1e4f13840532a2a300349a59c16_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

2a64c1e4f13840532a2a300349a59c16_JaffaCakes118
Size

181KB
MD5

2a64c1e4f13840532a2a300349a59c16
SHA1

8fa27a77b0ea738f4dd713e89998cc1c22162b05
SHA256

697b05b0dcd7037245a15eb39837ddebf8c30f483c6a81f82fd1338ecc6ba008
SHA512

d8af3f8cb32867c43105faf79803def4241885412045d458e29468a878e21fdb5e4a91dedf60fcb9e00e4afbf08ae3a6ddb17d5b4ce7daa345871fd328f99700
SSDEEP

3072:PjzR8oQsl2skML7PnWsBEJGkH14gPLJ6vp8PV4yKQrN9B4dSbBCmXwInsEtCMuw7:PjzRisl2TML7PnW3IU4gGMV4yKQrN9BR

Score

1^/10

Malware Config

Signatures

Files

2a64c1e4f13840532a2a300349a59c16_JaffaCakes118
.dll windows:5 windows x86 arch:x86

7a2f426d7dbac769c5692d7780831f71

Code Sign

11:74:bd:8a:9d:15:fb:43:b0:e8:fd:32:10:77:87:09
Certificate

Issuer

CN=bbbbbbbbbbbbbbbbbbbbbbbbbbbbbb HyCGyqLt8BeAjegoIji65pgJBi8bztBqanF6fywmidMlyMmkCMLBwFw3JtbyGlIBz7yqHmD9nxDl4Anjjmu ukv6B5n8bbjA dCaLw4px 55LhJpenJ23yiaaKqMGosfq7x9tq2j9omuKsejGf2rJaLaBmDJmBwlusI2dpyMowd2FDCMq5alpqn42lKMIyzcyMh9FgyHMnjfGgks8t6r3r8iqo69xEEayaHovF 3H3pecp 32IyIsmM v8y7yrEd8 w11 yo2aG3w4CpLnlfqwdA5v8vvMdAEkH87rqEKKF K1eHp1jjK9anMpe76GqdcqDMo6Gvu4M7rJwdwtrw6LbGhIlasxx6GB3 D8JM9I61tFEl5utj 416d1qiEz22lHglwKwDM5E499rlwI3AufcjetjHcbCuyKgGug3EGnjdDgpwaKIyGsn9MsrGcpyutIFaCk2uoiekgegFBvKFe1eELhJK Immf1le3xG48tyrbBuG1bakdMwE5lAIF hksH26xcDCEbCA7Jz5iae6v3vKGn4gF9G7DdIEcGcFfbIv32o9dzK2FBJpe6JjAj8EG85EplJv8tfi2tnGADrxxyg2A4D1equzznmm6ix3BBDJL6c2LAEMHtsIv5g4HwvItft7BJq9qtx2t7A oHL2Hn2KzCJ8tL64Ld6v3G55ij3GCaM6fvu21ddAjEichzt4x76Jsyb2FB7zpsKbyoDonIF8tiJFMF9qJect7yAi9pngv4sLtLELAas7GFkeaIa3gk2LlAyyFBMiH8yby4k7HD6He5iA5Ap47zJ ji3Li5ueACeemd8tJGiasEJ8x5jMIjH4HMCwsfkinlvzJFbdsKcfDy661J8DLcnxLxvlIec6fxub2ddzbIG6kqxqbjuyD1GgsfsKcc65ehrCK26xJCAym78oxhyHeE2lpxb7CjAhsbjq C42wCqIqyzc765mr8krmtpHKpdhvdq5kEGpknE47xnL89KlE2BbaB6yfJyxKsAa5xsjh L6kJlqHylJ31h558cD7hDIJiInGhezvFL2 ECsIrABwsrwttbxACGb7HG48LM32w5kCAok8Am7bzuAMp65no3x9dj335g1nymJ8bhEtqdH Mr3mLwCaBI8IwJhD12w4h vz2Fh1Jdg92lMuf4FtKAbsJ BxBspH7sEkLDaHw6xK2jJI28hApgC1y jta9M zg7ux2hwc7xhdqlxtHueIdhdr47k67nLpuF2a5k5L5MGBG5hBKDnv5lJG2Bp8xGEClAHf4AK5xrsMLAladEJqFaszszJDrr Gceuacjq5ApBBGip6bww6HtKMoraqzns6IbJ36IL8wKIAErlogccbGkwdggpnnaCpsgaqMip jFvmg8hBjr6HLiL ldrnJInn2rMwFicAcIBmhtzc31MkuHIfvCx5EisedebEGKma7ygsj8bmij68uIGyisBopKLucecIGyiEksyJ7685unH4n7EqsneHEnihl1 G4 uAr96FMn 6mjDMnyajxqg9BftnCc1zHuEvrbf 5v Gi nwB7HFyGp65nqLy4Cp4n2 LqlDbM1bjdLoepmkLyFoH2M164wt3Ja3xaga 4mdGFny7zhpIqBIe42xbFu1BGIi9E9JmIoaldw5HlLuJGErDM6ua3mhezkDMM4BkvpdLhxKmqnGhM5l3jcgwtqs1kkIldoui4o6hIguk5bkkMw e3F4BqGIfjvfFfatDAwky2L3pCsho3z8KxvIHECjE49iCyDIBfqykCp8ftDygH77Gcxqo9CnCxhaybvEAG qa3p4iKcoKv4D1uJmLlvGcBh bMy4yb 9hvFIgHi8yfEL 2anxcMrBrt1IKrwB38Awi5B4xvKgo16jvlgFkzAfLDFjKhiqtnCmdddoMx579ELCEr79jIBmp5kxwDldmuosDxoHyhnwxxAoxxLhGA9v aaaaaaaaaaaaaaaaaaaaaaa

Not Before

08-01-2013 17:26

Not After

31-12-2039 23:59

Subject

CN=bbbbbbbbbbbbbbbbbbbbbbbbbbbbbb HyCGyqLt8BeAjegoIji65pgJBi8bztBqanF6fywmidMlyMmkCMLBwFw3JtbyGlIBz7yqHmD9nxDl4Anjjmu ukv6B5n8bbjA dCaLw4px 55LhJpenJ23yiaaKqMGosfq7x9tq2j9omuKsejGf2rJaLaBmDJmBwlusI2dpyMowd2FDCMq5alpqn42lKMIyzcyMh9FgyHMnjfGgks8t6r3r8iqo69xEEayaHovF 3H3pecp 32IyIsmM v8y7yrEd8 w11 yo2aG3w4CpLnlfqwdA5v8vvMdAEkH87rqEKKF K1eHp1jjK9anMpe76GqdcqDMo6Gvu4M7rJwdwtrw6LbGhIlasxx6GB3 D8JM9I61tFEl5utj 416d1qiEz22lHglwKwDM5E499rlwI3AufcjetjHcbCuyKgGug3EGnjdDgpwaKIyGsn9MsrGcpyutIFaCk2uoiekgegFBvKFe1eELhJK Immf1le3xG48tyrbBuG1bakdMwE5lAIF hksH26xcDCEbCA7Jz5iae6v3vKGn4gF9G7DdIEcGcFfbIv32o9dzK2FBJpe6JjAj8EG85EplJv8tfi2tnGADrxxyg2A4D1equzznmm6ix3BBDJL6c2LAEMHtsIv5g4HwvItft7BJq9qtx2t7A oHL2Hn2KzCJ8tL64Ld6v3G55ij3GCaM6fvu21ddAjEichzt4x76Jsyb2FB7zpsKbyoDonIF8tiJFMF9qJect7yAi9pngv4sLtLELAas7GFkeaIa3gk2LlAyyFBMiH8yby4k7HD6He5iA5Ap47zJ ji3Li5ueACeemd8tJGiasEJ8x5jMIjH4HMCwsfkinlvzJFbdsKcfDy661J8DLcnxLxvlIec6fxub2ddzbIG6kqxqbjuyD1GgsfsKcc65ehrCK26xJCAym78oxhyHeE2lpxb7CjAhsbjq C42wCqIqyzc765mr8krmtpHKpdhvdq5kEGpknE47xnL89KlE2BbaB6yfJyxKsAa5xsjh L6kJlqHylJ31h558cD7hDIJiInGhezvFL2 ECsIrABwsrwttbxACGb7HG48LM32w5kCAok8Am7bzuAMp65no3x9dj335g1nymJ8bhEtqdH Mr3mLwCaBI8IwJhD12w4h vz2Fh1Jdg92lMuf4FtKAbsJ BxBspH7sEkLDaHw6xK2jJI28hApgC1y jta9M zg7ux2hwc7xhdqlxtHueIdhdr47k67nLpuF2a5k5L5MGBG5hBKDnv5lJG2Bp8xGEClAHf4AK5xrsMLAladEJqFaszszJDrr Gceuacjq5ApBBGip6bww6HtKMoraqzns6IbJ36IL8wKIAErlogccbGkwdggpnnaCpsgaqMip jFvmg8hBjr6HLiL ldrnJInn2rMwFicAcIBmhtzc31MkuHIfvCx5EisedebEGKma7ygsj8bmij68uIGyisBopKLucecIGyiEksyJ7685unH4n7EqsneHEnihl1 G4 uAr96FMn 6mjDMnyajxqg9BftnCc1zHuEvrbf 5v Gi nwB7HFyGp65nqLy4Cp4n2 LqlDbM1bjdLoepmkLyFoH2M164wt3Ja3xaga 4mdGFny7zhpIqBIe42xbFu1BGIi9E9JmIoaldw5HlLuJGErDM6ua3mhezkDMM4BkvpdLhxKmqnGhM5l3jcgwtqs1kkIldoui4o6hIguk5bkkMw e3F4BqGIfjvfFfatDAwky2L3pCsho3z8KxvIHECjE49iCyDIBfqykCp8ftDygH77Gcxqo9CnCxhaybvEAG qa3p4iKcoKv4D1uJmLlvGcBh bMy4yb 9hvFIgHi8yfEL 2anxcMrBrt1IKrwB38Awi5B4xvKgo16jvlgFkzAfLDFjKhiqtnCmdddoMx579ELCEr79jIBmp5kxwDldmuosDxoHyhnwxxAoxxLhGA9v aaaaaaaaaaaaaaaaaaaaaaa

Extended Key Usages

ExtKeyUsageCodeSigning

82:f8:c1:d7:99:20:89:62:53:cb:01:41:f3:49:ba:6f:02:37:90:e3
Signer

Actual PE Digest

82:f8:c1:d7:99:20:89:62:53:cb:01:41:f3:49:ba:6f:02:37:90:e3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetVolumeInformationW
GetVolumeNameForVolumeMountPointW
GetVolumePathNameW
GetWindowsDirectoryW
GlobalFree
HeapAlloc
HeapFree
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LoadResource
LocalFileTimeToFileTime
LocalFree
LockFile
LockResource
MoveFileExW
MultiByteToWideChar
PrepareTape
QueryPerformanceCounter
ReadFile
ReleaseMutex
ReleaseSemaphore
RemoveDirectoryW
SetCurrentDirectoryW
GetVersionExW
SetErrorMode
SetEvent
SetFileAttributesW
SetFilePointer
SetFileShortNameW
SetFileTime
SetLastError
SetTapeParameters
SetTapePosition
SetUnhandledExceptionFilter
Sleep
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
TerminateProcess
TerminateThread
UnhandledExceptionFilter
VerSetConditionMask
VerifyVersionInfoW
WaitForSingleObject
WideCharToMultiByte
WriteFile
WritePrivateProfileStringW
WriteTapemark
VirtualAlloc
GetUserDefaultLCID
GetTimeZoneInformation
GetTimeFormatW
GetTickCount
GetTapeStatus
GetTapePosition
GetTapeParameters
GetSystemTimeAsFileTime
GetSystemTime
GetSystemDirectoryW
GetStartupInfoW
GetProcessHeap
GetProcAddress
GetPrivateProfileStringW
GetNumberFormatW
GetModuleHandleA
GetModuleFileNameW
GetLogicalDriveStringsW
GetLocaleInfoW
GetLocalTime
BackupRead
GetLastError
GetFileSize
GetFileInformationByHandle
GetFileAttributesW
GetExitCodeThread
GetEnvironmentVariableW
GetDriveTypeW
GetDiskFreeSpaceExW
GetDateFormatW
GetCurrentThreadId
GetCurrentThread
GetCurrentProcessId
GetCurrentProcess
GetCurrentDirectoryW
GetCurrentDirectoryA
GetComputerNameW
GetCompressedFileSizeW
FreeLibrary
FormatMessageW
FlushFileBuffers
FindVolumeMountPointClose
FindResourceW
FindNextVolumeMountPointW
FindNextFileW
FindFirstVolumeMountPointW
FindFirstFileW
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
ExpandEnvironmentStringsW
ExitThread
EraseTape
EnterCriticalSection
DeviceIoControl
DeleteFileW
DeleteCriticalSection
CreateThread
CreateSemaphoreW
CreateProcessW
CreateMutexW
CreateHardLinkW
CreateFileW
CreateEventW
CreateDirectoryW
CompareStringW
CloseHandle
BackupWrite
BackupSeek
SetEndOfFile

user32

SendMessageW
SetActiveWindow
SetClassLongW
SetCursor
SetParent
SetTimer
SetWindowLongW
SetWindowPos
SetWindowTextW
SetWindowsHookExW
ShowWindow
SystemParametersInfoW
UnhookWindowsHookEx
UnregisterClassW
UpdateWindow
WindowFromPoint
wsprintfW
wvsprintfW
RegisterClassExA
LoadIconA
LoadCursorA
SendDlgItemMessageW
ScreenToClient
RemoveMenu
ReleaseDC
PostQuitMessage
PostMessageW
PeekMessageW
MonitorFromWindow
MessageBoxW
MapDialogRect
LockSetForegroundWindow
LoadStringW
LoadMenuW
LoadImageW
LoadIconW
LoadCursorW
LoadBitmapW
KillTimer
IsWindowVisible
IsWindow
IsIconic
IsCharAlphaW
IsCharAlphaNumericW
InvalidateRgn
InvalidateRect
InflateRect
GetWindowThreadProcessId
GetWindowTextW
GetWindowTextLengthW
GetWindowRect
GetWindowLongW
GetWindow
GetSystemMetrics
GetSysColor
GetSubMenu
GetParent
GetNextDlgGroupItem
GetMonitorInfoW
GetMenuItemID
GetMenuItemCount
GetMenu
GetKeyState
GetIconInfo
GetFocus
GetDlgItem
GetDesktopWindow
GetDC
GetCursorPos
GetClientRect
GetAsyncKeyState
GetActiveWindow
FlashWindow
ExitWindowsEx
EnableWindow
EnableMenuItem
DrawFocusRect
DestroyWindow
DestroyIcon
DeleteMenu
DefWindowProcW
CreateIconIndirect
CreateIconFromResource
CreateDialogParamW
CopyRect
ClientToScreen
ChildWindowFromPoint
CallNextHookEx
BringWindowToTop
AppendMenuW
GetCapture

gdi32

SelectObject
Rectangle
Polygon
PatBlt
GetTextExtentPoint32W
GetObjectW
GetMapMode
DeleteObject
CreateRectRgn
CreateFontIndirectW
CreateCompatibleDC
CreateCompatibleBitmap
CreateBitmap
CombineRgn
BitBlt

advapi32

StartServiceW
SetSecurityDescriptorDacl
SetFileSecurityW
SetEntriesInAclW
ReportEventW
RegisterEventSourceW
RegUnLoadKeyW
RegSetValueExW
RegSaveKeyW
RegRestoreKeyW
RegReplaceKeyW
RegQueryValueExW
RegQueryValueExA
RegOpenKeyW
RegOpenKeyExW
AddAccessAllowedAce
AdjustTokenPrivileges
AllocateAndInitializeSid
CheckTokenMembership
CloseEncryptedFileRaw
CloseServiceHandle
ControlService
DecryptFileW
DeleteAce
EncryptFileW
EnumDependentServicesW
EqualSid
FreeSid
GetAce
GetSecurityDescriptorDacl
GetTokenInformation
GetUserNameW
InitializeAcl
InitializeSecurityDescriptor
LookupAccountSidW
LookupPrivilegeValueW
OpenEncryptedFileRawW
OpenProcessToken
OpenSCManagerW
OpenServiceW
OpenThreadToken
QueryServiceStatus
ReadEncryptedFileRaw
RegCloseKey
RegConnectRegistryW
RegCreateKeyExW
RegDeleteValueW
RegEnumKeyExW
RegEnumValueW
RegFlushKey
RegLoadKeyW
RegOpenKeyExA
WriteEncryptedFileRaw

msvcrt

_CxxThrowException
_XcptFilter
__CxxFrameHandler
__dllonexit
__p__commode
__p__fmode
__set_app_type
__setusermatherr
__wgetmainargs
_adjust_fdiv
_c_exit
_cexit
_controlfp
_errno
_except_handler3
_exit
_fdopen
_filelength
_ftol
_getpid
_initterm
_local_unwind2
_mbscpy
_mbslen
_onexit
_open_osfhandle
_purecall
_putenv
_snwprintf
_tzset
_vsnwprintf
_wcmdln
_wcsdup
_wcsicmp
_wcslwr
_wcsnicmp
_wcsrev
_wcsupr
_wfopen
_wtoi
calloc
clearerr
exit
fclose
fflush
fread
free
fseek
ftell
fwrite
isalpha
isspace
localtime
malloc
memmove
mktime
realloc
swprintf
swscanf
time
wcscat
wcschr
wcscmp
wcscpy
wcslen
wcsncat
wcsncmp
wcsncpy
wcspbrk
wcsrchr
wcsstr
wcstok
wprintf

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 168B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data2
Size: 128KB - Virtual size: 127KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7a2f426d7dbac769c5692d7780831f71

Code Sign

11:74:bd:8a:9d:15:fb:43:b0:e8:fd:32:10:77:87:09Certificate

Extended Key Usages

82:f8:c1:d7:99:20:89:62:53:cb:01:41:f3:49:ba:6f:02:37:90:e3Signer

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

msvcrt

Sections

.text Size: 4KB - Virtual size: 3KB

.rdata Size: 14KB - Virtual size: 13KB

.data Size: 512B - Virtual size: 168B

.data2 Size: 128KB - Virtual size: 127KB

.rsrc Size: 19KB - Virtual size: 18KB

.reloc Size: 2KB - Virtual size: 1KB

11:74:bd:8a:9d:15:fb:43:b0:e8:fd:32:10:77:87:09
Certificate

82:f8:c1:d7:99:20:89:62:53:cb:01:41:f3:49:ba:6f:02:37:90:e3
Signer

.text
Size: 4KB - Virtual size: 3KB

.rdata
Size: 14KB - Virtual size: 13KB

.data
Size: 512B - Virtual size: 168B

.data2
Size: 128KB - Virtual size: 127KB

.rsrc
Size: 19KB - Virtual size: 18KB

.reloc
Size: 2KB - Virtual size: 1KB