3fd6f99d273273c2cd95c192091da811_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

3fd6f99d273273c2cd95c192091da811_JaffaCakes118
Size

199KB
MD5

3fd6f99d273273c2cd95c192091da811
SHA1

0a9241f291cb7f99f9d40f14c4dab939c0580efc
SHA256

c23875b8eb5386ebab0dfb7a813b0ea96217b0ef22d045166a4d01012b7c34b2
SHA512

1a11984d1f480ed078e6484f833a60b931184dde99fef07a7c8ae7efb8fa09d537ed95d260643e8075abeae8df44a8dc0d778690e9b074cbe18ab9094d7005db
SSDEEP

3072:KqhTUWiPIu/8MUZNyXBuSVdbVJtS0SzcdmmrV3yZ+Jt+gFy6SSip486pNo6IesVX:05XXBuGVe0SYdmMV3yZz2epz6phInV

Score

1^/10

Malware Config

Signatures

Files

3fd6f99d273273c2cd95c192091da811_JaffaCakes118
.dll windows:5 windows x86 arch:x86

f47b0fd540949b82d0b7398f987c0a1d

Code Sign

26:54:5c:87:7f:59:e4:b7:4c:cf:f3:58:35:25:9b:97
Certificate

Issuer

CN=THZpXsE59SFXxfh

Not Before

10/04/2012, 12:37

Not After

31/12/2039, 23:59

Subject

CN=THZpXsE59SFXxfh

Extended Key Usages

ExtKeyUsageCodeSigning

53:11:63:db:00:75:96:6d:a3:a2:b9:27:c8:73:e7:0e:e0:9d:e4:a9
Signer

Actual PE Digest

53:11:63:db:00:75:96:6d:a3:a2:b9:27:c8:73:e7:0e:e0:9d:e4:a9

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

VirtualAllocEx
AddAtomW
AddConsoleAliasW
CallNamedPipeW
CancelDeviceWakeupRequest
CompareStringW
ContinueDebugEvent
CopyFileA
CopyFileExW
CopyFileW
CreateFiber
CreateFileW
CreateMailslotW
CreateNamedPipeA
CreateRemoteThread
CreateSemaphoreA
CreateSemaphoreW
CreateWaitableTimerW
DebugBreak
DeleteAtom
DeleteCriticalSection
DeleteTimerQueueEx
DisconnectNamedPipe
DnsHostnameToComputerNameA
DuplicateHandle
EndUpdateResourceW
EnterCriticalSection
EnumCalendarInfoW
EnumDateFormatsExA
EnumLanguageGroupLocalesA
EnumSystemCodePagesW
EnumTimeFormatsA
EnumUILanguagesW
EscapeCommFunction
ExpandEnvironmentStringsW
FillConsoleOutputAttribute
FindFirstChangeNotificationA
FindFirstChangeNotificationW
FindFirstVolumeMountPointA
FindFirstVolumeMountPointW
FindFirstVolumeW
FindNextChangeNotification
FindNextFileA
FindNextVolumeA
FindNextVolumeMountPointW
FindResourceA
FindResourceExA
FindResourceExW
FindResourceW
FlushInstructionCache
FreeLibraryAndExitThread
FreeUserPhysicalPages
GenerateConsoleCtrlEvent
GetAtomNameA
GetCalendarInfoW
GetCommMask
GetCommModemStatus
GetCommandLineA
GetCommandLineW
GetCompressedFileSizeW
GetComputerNameA
GetConsoleAliasExesA
GetConsoleAliasesLengthA
GetConsoleTitleA
GetCurrentThreadId
GetDefaultCommConfigW
GetEnvironmentStrings
GetEnvironmentStringsA
GetExitCodeThread
GetFileAttributesExW
GetHandleInformation
GetLocaleInfoA
GetNamedPipeHandleStateA
GetNamedPipeHandleStateW
GetNamedPipeInfo
GetNumberFormatW
GetNumberOfConsoleInputEvents
GetNumberOfConsoleMouseButtons
GetPriorityClass
GetPrivateProfileIntA
GetPrivateProfileSectionW
GetPrivateProfileStringW
GetPrivateProfileStructW
GetProcessAffinityMask
GetProcessShutdownParameters
GetProcessTimes
GetProfileIntA
GetProfileIntW
GetProfileStringW
GetShortPathNameA
GetWindowsDirectoryW
GetStringTypeExW
GetStringTypeW
GetSystemDefaultUILanguage
GetSystemTimeAdjustment
GetThreadLocale
GetThreadPriorityBoost
GetUserDefaultLangID
GlobalAddAtomA
GlobalAlloc
GlobalCompact
GlobalFindAtomA
GlobalFlags
GlobalGetAtomNameW
GlobalMemoryStatus
Heap32ListFirst
Heap32Next
HeapValidate
InitAtomTable
InitializeCriticalSectionAndSpinCount
InterlockedExchangeAdd
IsBadStringPtrW
IsProcessorFeaturePresent
LeaveCriticalSection
LoadLibraryExW
LoadResource
LocalAlloc
LocalCompact
LocalLock
MapViewOfFile
Module32First
MoveFileExA
MoveFileW
OpenSemaphoreA
OpenWaitableTimerA
PeekConsoleInputW
Process32First
Process32FirstW
Process32NextW
QueryPerformanceFrequency
QueueUserAPC
ReadConsoleInputW
ReadFileScatter
ReadProcessMemory
RemoveDirectoryW
ReplaceFileW
RtlZeroMemory
SetCommConfig
SetConsoleScreenBufferSize
SetCurrentDirectoryA
SetDefaultCommConfigA
SetEvent
SetFileApisToANSI
SetFileAttributesA
SetLastError
SetLocalTime
SetProcessAffinityMask
SetStdHandle
SetSystemPowerState
SetThreadLocale
SleepEx
SwitchToFiber
SwitchToThread
SystemTimeToFileTime
TlsGetValue
Toolhelp32ReadProcessMemory
TransactNamedPipe
TransmitCommChar
UnhandledExceptionFilter
UnlockFileEx
VerLanguageNameA
VirtualLock
VirtualProtect
VirtualUnlock
WaitForDebugEvent
WaitForMultipleObjects
WaitForMultipleObjectsEx
WaitForSingleObjectEx
WriteConsoleOutputAttribute
WritePrivateProfileStringA
WritePrivateProfileStructW
_lclose
_llseek
_lopen
_lread
lstrcat
lstrcatA
lstrcmp
lstrcmpA
lstrcmpi
lstrlen
GetStartupInfoA
DosDateTimeToFileTime
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
RtlUnwind
IsDebuggerPresent

advapi32

RegOpenKeyW

oleaut32

DispCallFunc
DispGetIDsOfNames
DispGetParam
DosDateTimeToVariantTime
GetActiveObject
ClearCustData
LHashValOfNameSys
LHashValOfNameSysA
LPSAFEARRAY_Size
LPSAFEARRAY_UserFree
LPSAFEARRAY_UserMarshal
LoadTypeLibEx
OaBuildVersion
OleCreateFontIndirect
OleCreatePictureIndirect
OleCreatePropertyFrame
OleCreatePropertyFrameIndirect
OleIconToCursor
OleLoadPictureEx
OleLoadPictureFile
OleLoadPictureFileEx
OleLoadPicturePath
QueryPathOfRegTypeLi
RegisterActiveObject
RevokeActiveObject
SafeArrayAccessData
SafeArrayAllocDescriptorEx
SafeArrayCreateEx
SafeArrayCreateVector
SafeArrayDestroyData
SafeArrayGetDim
SafeArrayGetRecordInfo
SafeArrayGetVartype
SafeArrayPtrOfIndex
SafeArrayPutElement
SafeArrayRedim
SafeArraySetIID
SafeArraySetRecordInfo
SafeArrayUnlock
SysAllocString
SysAllocStringByteLen
SysAllocStringLen
SysFreeString
SysReAllocStringLen
SysStringByteLen
SysStringLen
SystemTimeToVariantTime
VARIANT_UserSize
VarAdd
VarAnd
VarBoolFromCy
VarBoolFromDate
VarBoolFromDec
VarBoolFromDisp
VarBoolFromI1
VarBoolFromR4
VarBoolFromR8
VarBoolFromStr
VarBoolFromUI1
VarBstrCat
VarBstrCmp
VarBstrFromCy
VarBstrFromDisp
VarBstrFromI1
VarBstrFromR4
VarBstrFromUI1
VarBstrFromUI2
VarCyCmp
VarCyCmpR8
VarCyFromBool
VarCyFromDate
VarCyFromDec
VarCyFromDisp
VarCyFromI1
VarCyFromR4
VarCyFromStr
VarCyFromUI1
VarCyInt
VarCyMul
VarCyRound
VarDateFromBool
VarDateFromCy
VarDateFromDec
VarDateFromDisp
VarDateFromI1
VarDateFromI2
VarDateFromR4
VarDateFromUI2
VarDateFromUI4
VarDateFromUdate
VarDateFromUdateEx
VarDecAdd
VarDecCmp
VarDecDiv
VarDecFix
VarDecFromDisp
VarDecFromI4
VarDecFromR4
VarDecFromStr
VarDecFromUI1
VarDecFromUI2
VarDecInt
VarDecNeg
VarDiv
VarEqv
VarFix
VarFormatCurrency
VarFormatFromTokens
VarI1FromBool
VarI1FromCy
VarI1FromDate
VarI1FromDec
VarI1FromI4
VarI1FromR4
VarI1FromR8
VarI1FromStr
VarI1FromUI1
VarI1FromUI4
VarI2FromCy
VarI2FromDate
VarI2FromDec
VarI2FromDisp
VarI2FromI4
VarI2FromR4
VarI2FromR8
VarI2FromStr
VarI2FromUI1
VarI2FromUI2
VarI2FromUI4
VarI4FromCy
VarI4FromDate
VarI4FromDec
VarI4FromDisp
VarI4FromI2
VarI4FromR8
VarI4FromUI1
VarI4FromUI2
VarI4FromUI4
VarIdiv
VarMonthName
VarMul
VarNeg
VarPow
VarR4CmpR8
VarR4FromDate
VarR4FromDec
VarR4FromI4
VarR4FromR8
VarR4FromStr
VarR4FromUI1
VarR4FromUI2
VarR8FromBool
VarR8FromCy
VarR8FromDate
VarR8FromDec
VarR8FromDisp
VarR8FromI1
VarR8FromI4
VarR8FromStr
VarR8FromUI4
VarR8Pow
VarSu
VarTokenizeFormatString
VarUI1FromCy
VarUI1FromDate
VarUI1FromDec
VarUI1FromDisp
VarUI1FromI4
VarUI1FromR8
VarUI1FromStr
VarUI1FromUI4
VarUI2FromBool
VarUI2FromDate
VarUI2FromDisp
VarUI2FromI1
VarUI2FromI4
VarUI2FromR4
VarUI2FromR8
VarUI2FromStr
VarUI2FromUI1
VarUI4FromBool
VarUI4FromCy
VarUI4FromDate
VarUI4FromI1
VarUI4FromI4
VarUI4FromStr
VarUI4FromUI1
VarUI4FromUI2
VarXor
VariantChangeTypeEx
VariantCopyInd
VariantInit
VariantTimeToDosDateTime
VariantTimeToSystemTime
VectorFromBstr
BSTR_UserUnmarshal
BSTR_UserSize
BSTR_UserMarshal
BSTR_UserFree
GetAltMonthNames

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 181KB - Virtual size: 181KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f47b0fd540949b82d0b7398f987c0a1d

Code Sign

26:54:5c:87:7f:59:e4:b7:4c:cf:f3:58:35:25:9b:97Certificate

Extended Key Usages

53:11:63:db:00:75:96:6d:a3:a2:b9:27:c8:73:e7:0e:e0:9d:e4:a9Signer

Headers

File Characteristics

Imports

kernel32

advapi32

oleaut32

Sections

.text Size: 5KB - Virtual size: 4KB

.rdata Size: 7KB - Virtual size: 7KB

.data Size: 181KB - Virtual size: 181KB

.CRT Size: 512B - Virtual size: 4B

.reloc Size: 3KB - Virtual size: 2KB

26:54:5c:87:7f:59:e4:b7:4c:cf:f3:58:35:25:9b:97
Certificate

53:11:63:db:00:75:96:6d:a3:a2:b9:27:c8:73:e7:0e:e0:9d:e4:a9
Signer

.text
Size: 5KB - Virtual size: 4KB

.rdata
Size: 7KB - Virtual size: 7KB

.data
Size: 181KB - Virtual size: 181KB

.CRT
Size: 512B - Virtual size: 4B

.reloc
Size: 3KB - Virtual size: 2KB