4120603a3fc39197037a70700c6af989_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

4120603a3fc39197037a70700c6af989_JaffaCakes118
Size

3.8MB
MD5

4120603a3fc39197037a70700c6af989
SHA1

c1f8f5f48904591e03aa5545926c0ecdc747512e
SHA256

122115d585cccb1b0355dcf5c63a0f46f5fdab166a8e521ac9d9ca68bd41d432
SHA512

5d8f1244a00b32ea8df3276bd80e6c4b12809ed0d76b1633e21c9da60b3b44a66d82f7874950deeeeed798583b0ace1cefa4dcce8a447854b465184f735e1fe2
SSDEEP

49152:lKWV2kVObTkSPe+K3l5TFvxtQTXASV2kscSQV1+37nblJlnH2znzM:ldV2dTdVacudH0g

Score

1^/10

Malware Config

Signatures

Files

4120603a3fc39197037a70700c6af989_JaffaCakes118
.exe windows:5 windows x86 arch:x86

9e76176900ad21f0e34da3109b543085

Code Sign

4e:cb:44:7d:28:4d:e4
Certificate

Issuer

SERIALNUMBER=07969287,CN=Go Daddy Secure Certification Authority,OU=http://certificates.godaddy.com/repository,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

01/07/2013, 11:52

Not After

30/03/2014, 15:26

Subject

CN=Descarga Segura LLC,O=Descarga Segura LLC,L=Wilmington,ST=DE,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

OU=Go Daddy Class 2 Certification Authority,O=The Go Daddy Group\, Inc.,C=US

Not Before

29/06/2004, 17:06

Not After

29/06/2034, 17:06

Subject

OU=Go Daddy Class 2 Certification Authority,O=The Go Daddy Group\, Inc.,C=US

03:01
Certificate

Issuer

OU=Go Daddy Class 2 Certification Authority,O=The Go Daddy Group\, Inc.,C=US

Not Before

16/11/2006, 01:54

Not After

16/11/2026, 01:54

Subject

SERIALNUMBER=07969287,CN=Go Daddy Secure Certification Authority,OU=http://certificates.godaddy.com/repository,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7a:75:99:0c:dd:3c:78:2e:61:ac:05:1a:d6:0a:61:67:04:15:55:e0
Signer

Actual PE Digest

7a:75:99:0c:dd:3c:78:2e:61:ac:05:1a:d6:0a:61:67:04:15:55:e0

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Proyectos\desktop_apps\MainExe_Installers\Installer\Debug\InstallerDebug.pdb

Imports

kernel32

CreateThread
GetLastError
WaitForSingleObject
Sleep
LoadResource
SizeofResource
GetFileSize
WriteFile
ReadFile
CloseHandle
GetModuleFileNameA
FindResourceA
CreateDirectoryA
CreateFileA
DeleteFileA
MoveFileA
SetFilePointer
SetFileTime
SystemTimeToFileTime
LocalFileTimeToFileTime
GetCurrentDirectoryA
GetFileAttributesA
TerminateThread
ExitProcess
CreateFileW
ReadConsoleW
WriteConsoleW
SetStdHandle
FreeLibrary
LoadLibraryW
LoadLibraryExW
OutputDebugStringW
GetTimeZoneInformation
SetConsoleCtrlHandler
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
SetFilePointerEx
GetFileType
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetProcessHeap
GetCurrentThreadId
GetCurrentThread
GetOEMCP
SetEndOfFile
LockResource
GetACP
IsValidCodePage
HeapSize
InterlockedIncrement
InterlockedDecrement
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InterlockedExchange
EncodePointer
DecodePointer
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
IsDebuggerPresent
IsProcessorFeaturePresent
RaiseException
RtlUnwind
HeapFree
HeapReAlloc
HeapAlloc
GetCommandLineA
InitializeCriticalSectionAndSpinCount
FatalAppExitA
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
GetProcAddress
CreateSemaphoreW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStdHandle
GetModuleFileNameW
GetModuleHandleExW
AreFileApisANSI
SetEnvironmentVariableA

user32

InvalidateRect
MoveWindow
GetClassInfoA
RegisterClassA
wsprintfA
LoadStringA
LoadIconA
LoadCursorA
SetWindowLongA
GetWindowLongA
BeginPaint
UpdateWindow
GetSystemMetrics
TranslateAcceleratorA
LoadAcceleratorsA
ShowWindow
CreateWindowExA
RegisterClassExA
PostQuitMessage
DefWindowProcA
DispatchMessageA
TranslateMessage
GetMessageA
EndPaint

gdi32

SetDIBitsToDevice

shell32

SHGetFolderPathA
ShellExecuteExA

Sections

.text
Size: 542KB - Virtual size: 541KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 89KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 135KB - Virtual size: 134KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9e76176900ad21f0e34da3109b543085

Code Sign

4e:cb:44:7d:28:4d:e4Certificate

Extended Key Usages

Key Usages

Certificate

03:01Certificate

Key Usages

7a:75:99:0c:dd:3c:78:2e:61:ac:05:1a:d6:0a:61:67:04:15:55:e0Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

shell32

Sections

.text Size: 542KB - Virtual size: 541KB

.rdata Size: 89KB - Virtual size: 89KB

.data Size: 12KB - Virtual size: 21KB

.idata Size: 4KB - Virtual size: 4KB

.rsrc Size: 135KB - Virtual size: 134KB

.reloc Size: 22KB - Virtual size: 21KB

4e:cb:44:7d:28:4d:e4
Certificate

03:01
Certificate

7a:75:99:0c:dd:3c:78:2e:61:ac:05:1a:d6:0a:61:67:04:15:55:e0
Signer

.text
Size: 542KB - Virtual size: 541KB

.rdata
Size: 89KB - Virtual size: 89KB

.data
Size: 12KB - Virtual size: 21KB

.idata
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 135KB - Virtual size: 134KB

.reloc
Size: 22KB - Virtual size: 21KB