2ccde5ad954f646a2c6022c09a5489ac_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

2ccde5ad954f646a2c6022c09a5489ac_JaffaCakes118
Size

52KB
MD5

2ccde5ad954f646a2c6022c09a5489ac
SHA1

50d8f356c7be12d1bd6f28f8f4758c6ed2baa963
SHA256

2877a9f615588e1375205c81a2e19d2d96d68842819ae7713b4e8b605b346762
SHA512

d5e7f1244fc527be2950fb8f3a05dd5906647b919ec45c74f8a6464a9e6c81b112291629c1a2f5901c7757e602f92fdceaa4800b4734acb5990b100525c2954f
SSDEEP

768:ShWCdwITRQEmni4kXc5pL+0nofCBvQG9LikySNAhjG59Z/6IILr50:ShjKviNAxoKBvQGoBPh2N2nu

Score

1^/10

Malware Config

Signatures

Files

2ccde5ad954f646a2c6022c09a5489ac_JaffaCakes118
.exe windows:4 windows x86 arch:x86

63ca4d191edb38b3cbf98e1f5c624e16

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

01
Certificate

Issuer

CN=Pike,OU=Development,O=PBCgroup,L=Belgrade,ST=Serbia,C=GB,1.2.840.113549.1.9.1=#0c10736d3234393540676d61696c2e636f6d

Not Before

09/05/2012, 14:01

Not After

09/05/2013, 14:01

Subject

CN=PikeUE,OU=Development,O=PBCgroup,L=Belgrade,ST=Serbia,C=GB,1.2.840.113549.1.9.1=#0c10736d3234393540676d61696c2e636f6d

04:36:c7:d3:9c:d1:0a:75:09:87:2a:19:fc:9c:8a:9f:e6:15:69:74
Signer

Actual PE Digest

04:36:c7:d3:9c:d1:0a:75:09:87:2a:19:fc:9c:8a:9f:e6:15:69:74

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetFileAttributesA
GetFileAttributesW
GetModuleFileNameW
Sleep
DeleteFileW
WaitForDebugEvent
ContinueDebugEvent
CreateProcessA
GetCommandLineA
GetStartupInfoA
CloseHandle
WriteFile
CreateFileA
WaitForSingleObject
CreateThread
SetFileAttributesW
GetProcAddress
LoadLibraryA
FindClose
OutputDebugStringA
LCMapStringA
GetOEMCP
GetACP
GetCPInfo
GetStringTypeW
GetLastError
MultiByteToWideChar
HeapFree
WideCharToMultiByte
GetModuleHandleA
GetVersion
ExitProcess
HeapAlloc
TerminateProcess
GetCurrentProcess
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
RtlUnwind
GetStringTypeA
LCMapStringW

ole32

CoCreateInstance
CoInitialize

shell32

SHGetSpecialFolderPathW

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

63ca4d191edb38b3cbf98e1f5c624e16

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:edCertificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

01Certificate

04:36:c7:d3:9c:d1:0a:75:09:87:2a:19:fc:9c:8a:9f:e6:15:69:74Signer

Headers

File Characteristics

Imports

kernel32

ole32

shell32

Sections

.text Size: 28KB - Virtual size: 27KB

.rsrc Size: 19KB - Virtual size: 18KB

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

01
Certificate

04:36:c7:d3:9c:d1:0a:75:09:87:2a:19:fc:9c:8a:9f:e6:15:69:74
Signer

.text
Size: 28KB - Virtual size: 27KB

.rsrc
Size: 19KB - Virtual size: 18KB