2ee7b2d5b64986256590623499091a79_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

2ee7b2d5b64986256590623499091a79_JaffaCakes118
Size

244KB
MD5

2ee7b2d5b64986256590623499091a79
SHA1

65881d427993de33e056fbc6936935328c08e2fa
SHA256

b8eb2f4b794d28b885ca34190a0e22646755bc46c80c40eda7f759dc3acfe4b7
SHA512

efc1edef04deda76ef6059c16710f009c260ce3080dd8cd02e5d072335f86726bc6183c2915ca20703a20eae3168cd932bcc4376a9371530269e3abb57499c45
SSDEEP

6144:qkmunGjdzaksI1xzUlDsGHZ887AvIOcA7np:qkHlks4xzOFP7MmA7np

Score

1^/10

Malware Config

Signatures

Files

2ee7b2d5b64986256590623499091a79_JaffaCakes118
.exe windows:4 windows x86 arch:x86

57328937ee3003bfb1e8f2e94ac35f8f

Code Sign

61:08:77:5f:00:00:00:00:00:4a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/07/2010, 22:53

Not After

19/10/2011, 22:53

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:03:dc:f6:00:00:00:00:00:0c
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:12

Not After

25/07/2011, 19:22

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:159C-A3F7-2570,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:15:08:27:00:00:00:00:00:0c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

25/01/2006, 23:22

Not After

25/01/2017, 23:32

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

0a:a8:7e:6f:56:00:66:64:59:c5:3a:bc:af:4a:59:bf:70:1d:9c:b4
Signer

Actual PE Digest

0a:a8:7e:6f:56:00:66:64:59:c5:3a:bc:af:4a:59:bf:70:1d:9c:b4

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

OpenEventA
GetCurrentProcess
GetStringTypeA
MoveFileW
lstrlen
lstrcmpA
GlobalFindAtomA
CreateMutexW
CreateMutexA
SetUnhandledExceptionFilter
IsBadCodePtr
GetCurrentDirectoryW
FileTimeToDosDateTime
lstrcpyW
RemoveDirectoryW
GetVolumeInformationA
ReplaceFileW
AddAtomW
SetComputerNameA
GetStartupInfoA
CreateEventW
CreateDirectoryW
GetEnvironmentVariableW
FindAtomA
OpenWaitableTimerW
BeginUpdateResourceW
GetShortPathNameW
GetCalendarInfoA
IsBadStringPtrA
GetDateFormatW
LoadLibraryA
FindResourceA
CreateDirectoryA
GetShortPathNameA
GetACP
GetTimeFormatW
GetNumberFormatW
GetWindowsDirectoryA
GetExpandedNameA
GetCurrentThreadId
ReadDirectoryChangesW
AddAtomA
GetEnvironmentStringsW
WaitForMultipleObjects
FileTimeToSystemTime
lstrcmp
TlsAlloc
GetAtomNameW
GetModuleFileNameA
GetTickCount
GetLocaleInfoW
OpenMutexA
GetWindowsDirectoryW
GetProcAddress
GetProcessHeap
OpenMutexW
MoveFileA
lstrcatA
CopyFileExA
GetNumberFormatA
ExpandEnvironmentStringsW
GetStartupInfoW
OpenSemaphoreA

user32

GetMessageW
SetDlgItemTextW
AppendMenuW
CopyRect
InsertMenuItemA
LoadCursorW
EnableMenuItem
MessageBoxIndirectA
GetDlgItemTextA
InvalidateRect
MoveWindow
UpdateLayeredWindow
MessageBoxW
GetCapture
TrackPopupMenu
SendDlgItemMessageW
EnumWindows
OffsetRect
CharNextA
SetCursorPos
DialogBoxIndirectParamA
IsChild
DestroyCursor
RegisterClassExA
IsIconic
CreateMenu
FindWindowW
GetMenu
wsprintfA
ShowCursor
RegisterWindowMessageA
LoadCursorA
MessageBoxIndirectW
InvalidateRgn
MessageBoxA
EndDialog
MonitorFromPoint
GetDesktopWindow
CharLowerW
GetSysColorBrush
mouse_event
MessageBeep
InsertMenuA
UnregisterClassA
LoadBitmapW
wvsprintfW
MonitorFromRect
GetTopWindow
MonitorFromWindow
LoadImageA
keybd_event
ShowWindow
SetCursor
GetKeyboardType
EnableWindow
GetAsyncKeyState
GetScrollPos
GetMenuItemInfoA
CharUpperA
ActivateKeyboardLayout
AdjustWindowRect
GetClassInfoA
GetDlgItemTextW
GetFocus
DestroyIcon
WaitMessage
DestroyMenu
AppendMenuA
LoadIconW
GetMenuItemRect
SetParent
GetWindowRgn
UnregisterClassW
GetMenuItemInfoW
CreateWindowExA
SendMessageW
LoadMenuW
CopyIcon
GetMessageA
LoadMenuIndirectA
GetMenuItemCount
ShowCaret
GetMenuItemID
GetActiveWindow
GetActiveWindow
IsDlgButtonChecked
CreateDialogIndirectParamA
IsMenu
wvsprintfA
GetMenuStringA
GetMenuState
RegisterClassA
SendDlgItemMessageA
TrackPopupMenuEx
WinHelpW
RemoveMenu
GetSysColor
CreateAcceleratorTableW
SetActiveWindow
CheckMenuItem
CharPrevW
CreateDesktopA
GetSystemMetrics
GetClassInfoExW
SetDlgItemTextA
WaitForInputIdle
CharLowerA
GetCapture
CreateDesktopW
RegisterClassW
CharNextW
GetClassInfoW
LoadBitmapA
LoadIconA
GetIconInfo
SetDlgItemInt
IsWindow
SetWindowRgn
SetMenu
GetDlgItemInt
CreateWindowExW

gdi32

CreateRoundRectRgn
GetStockObject
CreateDIBPatternBrush
CreateColorSpaceA
UpdateICMRegKeyA
CreateFontW
CreateColorSpaceW
CreateMetaFileA
CreateRectRgn

shell32

StrChrIA
StrRChrIA
StrCmpNIA
SHBrowseForFolderW
StrStrA
SHGetFolderPathA
SHGetDataFromIDListW
SHBrowseForFolder
ShellExecuteA

ws2_32

getprotobynumber
WSASendTo

urlmon

HlinkSimpleNavigateToMoniker
FindMediaType
AsyncInstallDistributionUnit
WriteHitLogging
ObtainUserAgentString
ZonesReInit
CoInternetGetSession
CoInternetQueryInfo
CreateFormatEnumerator
CreateURLMoniker
UrlMkSetSessionOption
GetComponentIDFromCLSSPEC
IsAsyncMoniker
RegisterBindStatusCallback
HlinkNavigateMoniker
CDLGetLongPathNameW
URLDownloadA
GetMarkOfTheWeb

winmm

waveInStart
mmTaskCreate
midiStreamRestart
joyReleaseCapture
mciGetDeviceIDFromElementIDA
mciSetYieldProc
wod32Message
mciDriverYield
mciSendStringA
midiOutSetVolume
waveOutGetErrorTextA
waveInAddBuffer
mciExecute
midiOutClose

odbctrac

TraceSQLGetData
TraceSQLError

inetcomm

HrAthGetFileName
MimeEditCreateMimeDocument
MimeOleCreateMessageParts

oledlg

OleUIChangeSourceW
OleUIUpdateLinksA
OleUIChangeIconA
OleUICanConvertOrActivateAs

sqlunirl

_InsertMenu_@20
_DlgDirList_@20

Sections

.v
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.BETRIf
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.zG
Size: 89KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.IuCOMg
Size: 7KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.evZv
Size: 14KB - Virtual size: 247KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.kt
Size: 92KB - Virtual size: 91KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.mkVpFq
Size: 5KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

57328937ee3003bfb1e8f2e94ac35f8f

Code Sign

61:08:77:5f:00:00:00:00:00:4aCertificate

Extended Key Usages

Key Usages

61:03:dc:f6:00:00:00:00:00:0cCertificate

Extended Key Usages

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

61:15:08:27:00:00:00:00:00:0cCertificate

Extended Key Usages

Key Usages

0a:a8:7e:6f:56:00:66:64:59:c5:3a:bc:af:4a:59:bf:70:1d:9c:b4Signer

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

ws2_32

urlmon

winmm

odbctrac

inetcomm

oledlg

sqlunirl

Sections

.v Size: 4KB - Virtual size: 4KB

.BETRIf Size: 11KB - Virtual size: 11KB

.zG Size: 89KB - Virtual size: 88KB

.IuCOMg Size: 7KB - Virtual size: 50KB

.evZv Size: 14KB - Virtual size: 247KB

.kt Size: 92KB - Virtual size: 91KB

.mkVpFq Size: 5KB - Virtual size: 6KB

.rsrc Size: 6KB - Virtual size: 6KB

61:08:77:5f:00:00:00:00:00:4a
Certificate

61:03:dc:f6:00:00:00:00:00:0c
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

61:15:08:27:00:00:00:00:00:0c
Certificate

0a:a8:7e:6f:56:00:66:64:59:c5:3a:bc:af:4a:59:bf:70:1d:9c:b4
Signer

.v
Size: 4KB - Virtual size: 4KB

.BETRIf
Size: 11KB - Virtual size: 11KB

.zG
Size: 89KB - Virtual size: 88KB

.IuCOMg
Size: 7KB - Virtual size: 50KB

.evZv
Size: 14KB - Virtual size: 247KB

.kt
Size: 92KB - Virtual size: 91KB

.mkVpFq
Size: 5KB - Virtual size: 6KB

.rsrc
Size: 6KB - Virtual size: 6KB