41346fa955cb447a4370deff275e5f6c_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

41346fa955cb447a4370deff275e5f6c_JaffaCakes118
Size

144KB
MD5

41346fa955cb447a4370deff275e5f6c
SHA1

b37e2295a4fd583ff4ec534ae5485bc34099c7cd
SHA256

9359354c7fdaea2a415727161c55a8159d1371b9f9e196175b40820c62652f1b
SHA512

b974e155c8f0549a2ad8da03e3438c2396576c904875edf0f9fbd7e8729bfb21e71100e605d08a071cbe9b1ebf1b0da5a4041693d8c53f2e7bec27006ce0e990
SSDEEP

3072:CkwIGVp/suloMf+lI8JfIg+oFIUYM8CeGpQ4:eltfgIg+oaUYMteKQ

Score

1^/10

Malware Config

Signatures

Files

41346fa955cb447a4370deff275e5f6c_JaffaCakes118
.exe windows:4 windows x86 arch:x86

0f88201de4585105b4340358cec0c9e0

Code Sign

4a:19:d2:38:8c:82:59:1c:a5:5d:73:5f:15:5d:dc:a3
Certificate

Issuer

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

Not Before

12/05/1997, 00:00

Not After

07/01/2004, 23:59

Subject

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

08:7a:6d:5c:6f:62:93:4f:ba:c4:fd:43:e1:14:18:9d
Certificate

Issuer

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

Not Before

28/02/2001, 00:00

Not After

06/01/2004, 23:59

Subject

CN=VeriSign Time Stamping Service,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)01,O=VeriSign\, Inc.

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:de:aa:11:d4:d8:40:9a:a8:be:e6
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/12/2000, 08:00

Not After

12/11/2005, 08:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:07:11:43:00:00:00:00:00:34
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/05/2002, 00:55

Not After

25/11/2003, 01:05

Subject

CN=Microsoft Corporation,OU=Copyright (c) 2002 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

8f:fa:72:2f:2a:9e:8e:ec:b7:22:e4:2b:d4:c7:a5:1c:e4:1e:93:5b
Signer

Actual PE Digest

8f:fa:72:2f:2a:9e:8e:ec:b7:22:e4:2b:d4:c7:a5:1c:e4:1e:93:5b

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

OInfoP11.pdb

Imports

oinfo11.ocx

GetOfficeData
DeleteOfficeData

kernel32

GetCommandLineA
GetModuleHandleA
LoadLibraryExA
FreeLibrary
LeaveCriticalSection
EnterCriticalSection
SetEvent
IsDBCSLeadByte
InterlockedDecrement
InterlockedIncrement
GetCurrentThreadId
GetModuleFileNameA
lstrcpynA
CreateEventA
CreateThread
Sleep
WaitForSingleObject
CloseHandle
FindResourceExA
FindResourceA
LoadResource
LockResource
SizeofResource
lstrlenA
lstrlenW
lstrcmpiA
GetVersion
DeleteCriticalSection
InitializeCriticalSection
GetLastError
RaiseException
WideCharToMultiByte
MultiByteToWideChar
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
VirtualQuery
GetSystemInfo
VirtualAlloc
VirtualProtect
GetStartupInfoA
SetLastError
GetModuleHandleW
GetProcAddress
GetFileAttributesW
LoadLibraryW
GetModuleFileNameW
OutputDebugStringA
LocalAlloc
LocalFree
GlobalLock
GlobalReAlloc
GlobalUnlock
GlobalHandle
GlobalAlloc
TlsGetValue
TlsAlloc
TlsSetValue
LocalReAlloc
GlobalFree
LoadLibraryA
lstrcmpW
lstrcatA
GlobalDeleteAtom
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
lstrcmpA
GlobalFlags
lstrcpyA
GetCPInfo
GetOEMCP
GetCurrentProcess

user32

SetWindowTextA
ClientToScreen
DestroyMenu
TabbedTextOutA
DrawTextA
DrawTextExA
GrayStringA
PostQuitMessage
RemovePropA
GetWindowTextA
GetForegroundWindow
GetDlgItem
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
LoadIconA
MapWindowPoints
GetClassInfoA
CreateWindowExA
GetClassInfoExA
RegisterClassA
SetForegroundWindow
GetMenu
PostMessageA
AdjustWindowRectEx
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
CopyRect
SetWindowLongA
SetWindowPos
PtInRect
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowRect
GetWindow
SetMenuItemBitmaps
GetFocus
ModifyMenuA
EnableMenuItem
CheckMenuItem
GetMenuCheckMarkDimensions
LoadBitmapA
LoadCursorA
GetSystemMetrics
GetDC
ReleaseDC
GetSysColor
GetSysColorBrush
SetWindowsHookExA
CallNextHookEx
GetKeyState
PeekMessageA
ValidateRect
GetMenuState
GetMenuItemID
UnregisterClassA
CharUpperA
GetMenuItemCount
UnhookWindowsHookEx
SendMessageA
MessageBoxA
RegisterWindowMessageA
WinHelpA
GetCapture
GetClassLongA
GetClassNameA
SetPropA
DispatchMessageA
TranslateMessage
GetMessageA
PostThreadMessageA
CharNextA
GetClientRect
GetPropA
EnableWindow
IsWindowEnabled
GetLastActivePopup
GetWindowLongA
GetParent
GetSubMenu

advapi32

RegEnumKeyExA
RegQueryInfoKeyA
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA

shlwapi

PathFindExtensionA

ole32

CoCreateInstance
StringFromGUID2
CoUninitialize
CoTaskMemRealloc
CoTaskMemFree
CoTaskMemAlloc
CoRegisterClassObject
CoRevokeClassObject
CoInitialize

oleaut32

VariantInit
VariantChangeType
SysStringLen
LoadRegTypeLi
VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
SysAllocString
VarUdateFromDate
VarBstrFromDate
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayGetElement
VariantClear
SysAllocStringLen
SysFreeString

msvcrt

realloc
_CxxThrowException
malloc
_controlfp
??1type_info@@UAE@XZ
ctime
mktime
gmtime
localtime
time
_vsnwprintf
_onexit
__dllonexit
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_amsg_exit
free
_except_handler3
_vsnprintf
memmove
_acmdln
exit
_cexit
_ismbblead
_wcsicmp
_XcptFilter
_exit
_c_exit
_mbctype
_expand
_mbscmp
_msize
__CxxFrameHandler
memcpy
memset
strftime

oleacc

LresultFromObject
CreateStdAccessibleObject

gdi32

GetStockObject
DeleteDC
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
TextOutA
RectVisible
PtVisible
CreateBitmap
GetClipBox
SetTextColor
SetBkColor
DeleteObject
ExtTextOutA
SaveDC
RestoreDC
SetMapMode
GetDeviceCaps

winspool.drv

DocumentPropertiesA
OpenPrinterA
ClosePrinter

Exports

Exports

_ctime64
_gmtime64
_localtime64
_mktime64
_resetstkoflw
_scprintf
_scwprintf
_time64
_vscprintf
_vscwprintf

Sections

.text
Size: 103KB - Virtual size: 103KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 37KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

fgvddef
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

0f88201de4585105b4340358cec0c9e0

Code Sign

4a:19:d2:38:8c:82:59:1c:a5:5d:73:5f:15:5d:dc:a3Certificate

08:7a:6d:5c:6f:62:93:4f:ba:c4:fd:43:e1:14:18:9dCertificate

Extended Key Usages

Key Usages

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate

6a:0b:99:4f:c0:00:de:aa:11:d4:d8:40:9a:a8:be:e6Certificate

Extended Key Usages

Key Usages

61:07:11:43:00:00:00:00:00:34Certificate

Extended Key Usages

Key Usages

8f:fa:72:2f:2a:9e:8e:ec:b7:22:e4:2b:d4:c7:a5:1c:e4:1e:93:5bSigner

Headers

File Characteristics

PDB Paths

Imports

oinfo11.ocx

kernel32

user32

advapi32

shlwapi

ole32

oleaut32

msvcrt

oleacc

gdi32

winspool.drv

Exports

Exports

Sections

.text Size: 103KB - Virtual size: 103KB

.data Size: 2KB - Virtual size: 10KB

.rsrc Size: 37KB - Virtual size: 38KB

fgvddef Size: - Virtual size: 4KB

4a:19:d2:38:8c:82:59:1c:a5:5d:73:5f:15:5d:dc:a3
Certificate

08:7a:6d:5c:6f:62:93:4f:ba:c4:fd:43:e1:14:18:9d
Certificate

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

6a:0b:99:4f:c0:00:de:aa:11:d4:d8:40:9a:a8:be:e6
Certificate

61:07:11:43:00:00:00:00:00:34
Certificate

8f:fa:72:2f:2a:9e:8e:ec:b7:22:e4:2b:d4:c7:a5:1c:e4:1e:93:5b
Signer

.text
Size: 103KB - Virtual size: 103KB

.data
Size: 2KB - Virtual size: 10KB

.rsrc
Size: 37KB - Virtual size: 38KB

fgvddef
Size: - Virtual size: 4KB