4597a35c20aa8480a43dbd9459bcf38c_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

4597a35c20aa8480a43dbd9459bcf38c_JaffaCakes118
Size

58KB
MD5

4597a35c20aa8480a43dbd9459bcf38c
SHA1

59b6560908d1af8eea3d4b1ac702982756bcd1a3
SHA256

85e4d36413f3771d5bc5e03c431fb5c634d3a3fcb3cda7693d268caab596373f
SHA512

490d1143353e07f5c55423ea8856f4c2ff0040305eabba018a0c5b81190ba7fabaca07114598540cc9ea46bf3a2dd39f6ad4c78f97331694bc3d47a55a4c7aa7
SSDEEP

1536:aKW5P12GUFX4593IWnHm/lHm/1Hm/BHm/0evwZu:aKWKGUZ45phm/Vm/lm/Zm/0evwY

Score

1^/10

Malware Config

Signatures

Files

4597a35c20aa8480a43dbd9459bcf38c_JaffaCakes118
.exe windows:5 windows x86 arch:x86

6016c470536fc1799b647a31150b5e2f

Code Sign

17:1e:97:b2:96:3d:6f:75:b5:6e:b2:58:64:56:43:96
Certificate

Issuer

CN=LFD5mG6B6E2hCrvaHE6vykJAxrloEqiLMcM8M B9ao2pa 2BEH22oid5J9qiD yuK7m3amoawD6Gn4xmensjLdys3BMilv9xmC6unDydfkuls hGDMvwxrc7DF5msIEp7kFp7LGCzieLdh9zvAEx6DD6panwwEc3v4nvM5L54i44Mkt7JckvktHald E2gAzhrHLJJ319tz89z7m3lJ1Fw8ag7pv8etFF7ugeq5a2HaD5KcEfrbMe37uJjgu9k7FKyihL2gfpua5h8pt7ogdu5xzMEGJxrrqn5hpM6sr23MC1hs2B72di Jhe1Ff92w6d2MJxEAHl iLKgmurJpq6pa7sdgjale5M5Mq79Ap MtJw4h3CmajagDLvLrtIbz9dIgJ7feCDnhudHvlE8Kcqg4wnzGbGGlCCpae1k5M6o4j715d4Jbo74EgkD6rlLBrLxImktthFy1ebuto92IuFfeuf9p lFItJGBH1rzbujwLH73 fIDH9wfsgHiybn2vo7gyodrHAuw8E h3if7kKCD2IBje8pD1jIn4fDr25Kpisnn aaKjylau2LHipEnfreC4ejtovyrKplzIqe6Lm4renAsrHbBI3f4kA4msmdkHeyDqyDJ9bmAB7xccKJ7IK28qH31H1CBvh7caC7u cBF7o uI7khE2p9nGkjnocb9qyhrhGDoFBGuz9c11BJArGqjsB9rkJeABJ5jwnD1lg1dwqyvo1mkMvokq6ctDgb1Dbv msezoGheMhtaL IhLEpqauBbtbMIgcj3IqxksdwpDqt2G6jHzzjyFEJqa8f69tIE2aBwgeDatChq4 Jh88Ax9BgB1 5uA3jFgE dysdFLLtvb5yfofDc3myk51 DBqj2qJm8826H2eFIogDoJnkDHy8J6f7n4z3h8flIjtu5aLo8Gim8LnJpkFG4EeAlng1qtD4lBEHKGdz4wFF52IFayECqgCnMirDh2gmdyKagz1subucG82KlJe94qi5 K16dMFl98MpIfjACInH5brlmMwrqMGg2yhEMpqzqLsFr3wwm5MJweM9luIeEtimycF8jI8hgl5jM6vyqcnmsjIwmm3AC8MtxctdrK4lc8yvACJErnbxArh3nEC9q JcpoDr3tyFeAEmJpqt5 nAsxthjAKFail AEgxratgbi6Dnl lpekBygcsCH77BxEKuK7G6nMm6MgCJvEu1qh 9BfuBt9dHHloGoFz9y6v2y6vvzbao96sa1ny9AM4iu9r3AlJoCpIro71 Gtgx oMFwFFh63nAFeCGx3g1L IxlFsh96KHkLrcnFBxe 7jAJjbKB9K9hBowLBzKd4nm5FFxH1ctDFvxupkGEByu4BduceKsAplmrpIvp1cfqwHisG1naJzp8naDilbypppExhnkdg5fc8oAp4Kw5rBs89j445B6fILKvos9A8EyBhGItoqMlBtt2w4fDkyHfryDDjf26848zhiguCz yrMHIMgGrwdeKajIqGAl82Ctxsl7FHkElJykLB4 Lv6IKmjbLEJJvDh4Khu3EzM8v px7p9B46FCav3m gB6iMrzum27e3sbm4l23jeumi8JDbnHGrAjA5LAzcH1gaDELIvgIKlqi62q1xk4 6AgAqwcbuL5aB4rdyz82k5y jpCimgmH4eCsAl2JBHbxHaggExvd41gvyjEmH dMwxoxx27oac JshbKEAt4CmCLBDDcK4yJIa44l6au6pwwqdfuLfrcxIlj9jFuamn7ikqJA3177H9AEAD7mEJGu34d5EFI7ewscaamAtx64xDiaaAGlywnrjjBn1x 3vrsFAGfMLqezeCCb7JwMiecd694b5kAvy2gthK4qhJFalzmdq1LfnB8u8da pvKsJndsd337najA7Jt6ggA8holMw6BICbEh53BLDx5gB AJ4DkcxB16C8ujtmc8vpF daHH2tsebtFv21FK7J8CHnH 5BdJGBELb6vxxhAaLxjtxw36dBKk1j3bloCIv144w9H1yf9kB8eoiyCpo61s2jyt1d rovbo77nkrumMIEnahnFfnMoi376bhyIstHa4ibhg2CuwiGdH fhalyyGL9cdMgLwvawbG24ls4n 2Kp4bJiL6KbiIaDzk7L1I3qIFflJGJIBusupKorCmpmirLbooa2Jfa611 kbHxuwq2mzfxkkf7erc6EmLhJsdrtf44kAd5M3khniasoH2pM8z8shmoBa6s59bdw8ErCEjHv4G2iqk7JucxI5xCqrwwwqc57FrtbE97m28lucJouo b5jjertI6LIkKg84cLcz4Bjln7sJKyxuLDsnHiwh5pkpF7aqpHK5Hzdgk424yAwB7 yHK3pjB8awn3ddEeEnJ5h9mICAbmkjb GvnLhBdoHbsBzhIJIem9Ddjohp 7dHAh67Lkztlqt6v5u8zApI2IDj3z47KfCGduHzo ts2gLnHciymLfE9IqA1sdpkqzHLI6p9xiDbLKgq29otblo LakH9pik2FzbeC3CL72pi49zfmyGszaADDFepdrAz czvfinicn7ecCrlyqn1AJe f9nfJnEz15qxqic8JtchsuIM1DEb2pnzB4kMu74regcAdak1qheC2LtLE9vt29I1LgrHKxqv1lHDGrKt8ycuwcjno37mjJB8q9CDFMz3zt ogh6rBmE2G3E3kC9kFdFpIwmArAAmaGgDj7DeFKa w9acpwvJEzjuesh 53Bsv7mdqufF2KFwFK3s9ysdpKfvBh2D831v42L 6jupKqjsybzFI38svoashpjfyihvAhC1le Cvc5cGLakEkk3hBvBIitBIMCJxDFnbwhcIAphkerCD6wwvIg8fBlJ9aHLF8M9IMbw5HhqDabt4G2Fcwa9jMsC2wMio88762EElA6rA27trAp1B1dLcvi2bGC76ycbIuh3EqJIcJb 3FjwjxzgJ15y4Mhfj7H7pbC6HwGB81eCn2oxGIAs2yrJ8Ke 2u6xqi6wn9JAxfI2Dbu1m kvMp9g3dDkFDuwrIEapvm8j6BzIlK58h42A 6wwa3Fy7K2933E9F6vwuc9BGa9v7Az mCow8Ktu57E3CoJzD1IGMq6MuqD7M55kntc3pzkGc5mfv1JpdcaHjqw1joavjr KFviAqgf2g1Kp9bJLgK9GjKBEnMu 3mkcHxgD38z3EFafc52Em6afri96xdfvAALbcDvwbqqvHz2rkra4ylHCslJjvKnq4wwFCn6scpMbDoDCltLw9uwalw9e26dgnf5Dpwnfmex8HxJbtf7Jy4ACir scDAum7M974Kdykpgkgh7nKHKnFIM 3owHC19ki3641o7Mvzy7HAgB4JIkEdw8KkiC29tjFLk FMgh58oGcaEaG5zoItIiuEAqD2Fxflrs7 6 FHyl5mau8oMmfgK1gMFDCxl6wax9FjoApCvakFF9jHG5fxgwseyoyCAz6wp5Jicxt1GhgiwH7Dh9kAHG3ei91IslwmeDawE13EKvo6Ck1Ll2vj2LrvA9iodlL5rCJGtA1Imup CltIHfsitmvfw8rt jopgBhkxmhyBuxIkDM6qMrd21A7bI69deD5EDDu7yrKE267Dak8h5plfFpgysnBBiJrkA7syipam u3iofgskGha2uerGifsMqG2jibsmpel4akFoI3uBnkgms8zKGrtrEavytq6aEdr6oimaLjedwLnHC2oK3fjsokIGfqzMwq5eEe 6F678MIf4nHraicevIttl9chaLEwKC6y ig Jf3lI tGchEljHbAqm13jod7bczAdEsqJ84izgooA iB46hi7wHCJybxIewxBD7K4o1ox6t339F7GCmsz9n4GFn1Kdl9ikCu4gdJe3LdD44GzausMbDDM9FFoE5nKudaubGoLvHyw1niqkl7Ie cz5sGGFwLMEtto15zLDyaqq8qsvEeImk

Not Before

21/12/2012, 07:29

Not After

31/12/2039, 23:59

Subject

CN=LFD5mG6B6E2hCrvaHE6vykJAxrloEqiLMcM8M B9ao2pa 2BEH22oid5J9qiD yuK7m3amoawD6Gn4xmensjLdys3BMilv9xmC6unDydfkuls hGDMvwxrc7DF5msIEp7kFp7LGCzieLdh9zvAEx6DD6panwwEc3v4nvM5L54i44Mkt7JckvktHald E2gAzhrHLJJ319tz89z7m3lJ1Fw8ag7pv8etFF7ugeq5a2HaD5KcEfrbMe37uJjgu9k7FKyihL2gfpua5h8pt7ogdu5xzMEGJxrrqn5hpM6sr23MC1hs2B72di Jhe1Ff92w6d2MJxEAHl iLKgmurJpq6pa7sdgjale5M5Mq79Ap MtJw4h3CmajagDLvLrtIbz9dIgJ7feCDnhudHvlE8Kcqg4wnzGbGGlCCpae1k5M6o4j715d4Jbo74EgkD6rlLBrLxImktthFy1ebuto92IuFfeuf9p lFItJGBH1rzbujwLH73 fIDH9wfsgHiybn2vo7gyodrHAuw8E h3if7kKCD2IBje8pD1jIn4fDr25Kpisnn aaKjylau2LHipEnfreC4ejtovyrKplzIqe6Lm4renAsrHbBI3f4kA4msmdkHeyDqyDJ9bmAB7xccKJ7IK28qH31H1CBvh7caC7u cBF7o uI7khE2p9nGkjnocb9qyhrhGDoFBGuz9c11BJArGqjsB9rkJeABJ5jwnD1lg1dwqyvo1mkMvokq6ctDgb1Dbv msezoGheMhtaL IhLEpqauBbtbMIgcj3IqxksdwpDqt2G6jHzzjyFEJqa8f69tIE2aBwgeDatChq4 Jh88Ax9BgB1 5uA3jFgE dysdFLLtvb5yfofDc3myk51 DBqj2qJm8826H2eFIogDoJnkDHy8J6f7n4z3h8flIjtu5aLo8Gim8LnJpkFG4EeAlng1qtD4lBEHKGdz4wFF52IFayECqgCnMirDh2gmdyKagz1subucG82KlJe94qi5 K16dMFl98MpIfjACInH5brlmMwrqMGg2yhEMpqzqLsFr3wwm5MJweM9luIeEtimycF8jI8hgl5jM6vyqcnmsjIwmm3AC8MtxctdrK4lc8yvACJErnbxArh3nEC9q JcpoDr3tyFeAEmJpqt5 nAsxthjAKFail AEgxratgbi6Dnl lpekBygcsCH77BxEKuK7G6nMm6MgCJvEu1qh 9BfuBt9dHHloGoFz9y6v2y6vvzbao96sa1ny9AM4iu9r3AlJoCpIro71 Gtgx oMFwFFh63nAFeCGx3g1L IxlFsh96KHkLrcnFBxe 7jAJjbKB9K9hBowLBzKd4nm5FFxH1ctDFvxupkGEByu4BduceKsAplmrpIvp1cfqwHisG1naJzp8naDilbypppExhnkdg5fc8oAp4Kw5rBs89j445B6fILKvos9A8EyBhGItoqMlBtt2w4fDkyHfryDDjf26848zhiguCz yrMHIMgGrwdeKajIqGAl82Ctxsl7FHkElJykLB4 Lv6IKmjbLEJJvDh4Khu3EzM8v px7p9B46FCav3m gB6iMrzum27e3sbm4l23jeumi8JDbnHGrAjA5LAzcH1gaDELIvgIKlqi62q1xk4 6AgAqwcbuL5aB4rdyz82k5y jpCimgmH4eCsAl2JBHbxHaggExvd41gvyjEmH dMwxoxx27oac JshbKEAt4CmCLBDDcK4yJIa44l6au6pwwqdfuLfrcxIlj9jFuamn7ikqJA3177H9AEAD7mEJGu34d5EFI7ewscaamAtx64xDiaaAGlywnrjjBn1x 3vrsFAGfMLqezeCCb7JwMiecd694b5kAvy2gthK4qhJFalzmdq1LfnB8u8da pvKsJndsd337najA7Jt6ggA8holMw6BICbEh53BLDx5gB AJ4DkcxB16C8ujtmc8vpF daHH2tsebtFv21FK7J8CHnH 5BdJGBELb6vxxhAaLxjtxw36dBKk1j3bloCIv144w9H1yf9kB8eoiyCpo61s2jyt1d rovbo77nkrumMIEnahnFfnMoi376bhyIstHa4ibhg2CuwiGdH fhalyyGL9cdMgLwvawbG24ls4n 2Kp4bJiL6KbiIaDzk7L1I3qIFflJGJIBusupKorCmpmirLbooa2Jfa611 kbHxuwq2mzfxkkf7erc6EmLhJsdrtf44kAd5M3khniasoH2pM8z8shmoBa6s59bdw8ErCEjHv4G2iqk7JucxI5xCqrwwwqc57FrtbE97m28lucJouo b5jjertI6LIkKg84cLcz4Bjln7sJKyxuLDsnHiwh5pkpF7aqpHK5Hzdgk424yAwB7 yHK3pjB8awn3ddEeEnJ5h9mICAbmkjb GvnLhBdoHbsBzhIJIem9Ddjohp 7dHAh67Lkztlqt6v5u8zApI2IDj3z47KfCGduHzo ts2gLnHciymLfE9IqA1sdpkqzHLI6p9xiDbLKgq29otblo LakH9pik2FzbeC3CL72pi49zfmyGszaADDFepdrAz czvfinicn7ecCrlyqn1AJe f9nfJnEz15qxqic8JtchsuIM1DEb2pnzB4kMu74regcAdak1qheC2LtLE9vt29I1LgrHKxqv1lHDGrKt8ycuwcjno37mjJB8q9CDFMz3zt ogh6rBmE2G3E3kC9kFdFpIwmArAAmaGgDj7DeFKa w9acpwvJEzjuesh 53Bsv7mdqufF2KFwFK3s9ysdpKfvBh2D831v42L 6jupKqjsybzFI38svoashpjfyihvAhC1le Cvc5cGLakEkk3hBvBIitBIMCJxDFnbwhcIAphkerCD6wwvIg8fBlJ9aHLF8M9IMbw5HhqDabt4G2Fcwa9jMsC2wMio88762EElA6rA27trAp1B1dLcvi2bGC76ycbIuh3EqJIcJb 3FjwjxzgJ15y4Mhfj7H7pbC6HwGB81eCn2oxGIAs2yrJ8Ke 2u6xqi6wn9JAxfI2Dbu1m kvMp9g3dDkFDuwrIEapvm8j6BzIlK58h42A 6wwa3Fy7K2933E9F6vwuc9BGa9v7Az mCow8Ktu57E3CoJzD1IGMq6MuqD7M55kntc3pzkGc5mfv1JpdcaHjqw1joavjr KFviAqgf2g1Kp9bJLgK9GjKBEnMu 3mkcHxgD38z3EFafc52Em6afri96xdfvAALbcDvwbqqvHz2rkra4ylHCslJjvKnq4wwFCn6scpMbDoDCltLw9uwalw9e26dgnf5Dpwnfmex8HxJbtf7Jy4ACir scDAum7M974Kdykpgkgh7nKHKnFIM 3owHC19ki3641o7Mvzy7HAgB4JIkEdw8KkiC29tjFLk FMgh58oGcaEaG5zoItIiuEAqD2Fxflrs7 6 FHyl5mau8oMmfgK1gMFDCxl6wax9FjoApCvakFF9jHG5fxgwseyoyCAz6wp5Jicxt1GhgiwH7Dh9kAHG3ei91IslwmeDawE13EKvo6Ck1Ll2vj2LrvA9iodlL5rCJGtA1Imup CltIHfsitmvfw8rt jopgBhkxmhyBuxIkDM6qMrd21A7bI69deD5EDDu7yrKE267Dak8h5plfFpgysnBBiJrkA7syipam u3iofgskGha2uerGifsMqG2jibsmpel4akFoI3uBnkgms8zKGrtrEavytq6aEdr6oimaLjedwLnHC2oK3fjsokIGfqzMwq5eEe 6F678MIf4nHraicevIttl9chaLEwKC6y ig Jf3lI tGchEljHbAqm13jod7bczAdEsqJ84izgooA iB46hi7wHCJybxIewxBD7K4o1ox6t339F7GCmsz9n4GFn1Kdl9ikCu4gdJe3LdD44GzausMbDDM9FFoE5nKudaubGoLvHyw1niqkl7Ie cz5sGGFwLMEtto15zLDyaqq8qsvEeImk

Extended Key Usages

ExtKeyUsageCodeSigning

9d:26:69:e3:62:6b:73:43:71:a7:95:c2:85:e8:a0:64:92:5a:b4:87
Signer

Actual PE Digest

9d:26:69:e3:62:6b:73:43:71:a7:95:c2:85:e8:a0:64:92:5a:b4:87

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLastError
GetLogicalDrives
GetModuleHandleA
GetProcessHeap
GetStdHandle
GetSystemTimeAsFileTime
GetTickCount
GetTimeFormatW
GetVolumeInformationW
HeapAlloc
HeapFree
LoadLibraryA
LocalFree
OpenProcess
QueryPerformanceCounter
ReadConsoleW
GetDriveTypeW
SetConsoleMode
SetLastError
SetUnhandledExceptionFilter
TerminateProcess
UnhandledExceptionFilter
VerSetConditionMask
VerifyVersionInfoW
VirtualAlloc
WideCharToMultiByte
WriteConsoleW
lstrcatW
lstrcmpW
lstrcmpiW
lstrcpyW
lstrcpynW
lstrlenW
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
GetConsoleScreenBufferInfo
GetConsoleMode
GetComputerNameExW
FormatMessageW
FindFirstFileW
FindClose
FileTimeToSystemTime
CompareStringW
CloseHandle
ReadFile
GetStartupInfoW
GetSystemDirectoryA
lstrcatA
CreateFileA
SetConsoleCursorPosition
VirtualAllocEx

advapi32

RegSetValueExW
RegSetValueExA
RegQueryValueExW
RegQueryValueExA
RegQueryInfoKeyW
RegQueryInfoKeyA
RegOpenKeyExW
RegOpenKeyExA
RegEnumValueW
RegEnumValueA
RegEnumKeyA
RegCreateKeyExW
RegCreateKeyExA
RegCloseKey
GetUserNameA
GetFileSecurityW
RegOpenKeyA
SetFileSecurityW

msvcrt

memcpy
_CIpow
_XcptFilter
__CxxFrameHandler
__dllonexit
__p__commode
__p__fmode
__set_app_type
__setusermatherr
__wgetmainargs
_adjust_fdiv
_beginthreadex
_c_exit
_cexit
_controlfp
_except_handler3
_exit
_ftol
_initterm
_onexit
_purecall
_snwprintf
_stricmp
_strnicmp
_ultow
_vsnprintf
_vsnwprintf
_wcmdln
_wcsicmp
_wcsnicmp
_wcsupr
_wtoi
_wtoi64
_wtol
abs
atoi
atol
bsearch
ceil
exit
floor
free
isdigit
isspace
iswalnum
iswascii
iswcntrl
iswdigit
iswspace
isxdigit
malloc
memcmp
memmove
memset
qsort
rand
realloc
srand
strchr
strncpy
swprintf
swscanf
toupper
towlower
towupper
wcscat
wcschr
wcscmp
wcscpy
wcscspn
wcslen
wcsncmp
wcsncpy
wcspbrk
wcsrchr
wcsspn
wcsstr
wcstombs
wcstoul

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.tex
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

6016c470536fc1799b647a31150b5e2f

Code Sign

17:1e:97:b2:96:3d:6f:75:b5:6e:b2:58:64:56:43:96Certificate

Extended Key Usages

9d:26:69:e3:62:6b:73:43:71:a7:95:c2:85:e8:a0:64:92:5a:b4:87Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

msvcrt

Sections

.text Size: 3KB - Virtual size: 2KB

.tex Size: 1KB - Virtual size: 1KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: 25KB - Virtual size: 25KB

17:1e:97:b2:96:3d:6f:75:b5:6e:b2:58:64:56:43:96
Certificate

9d:26:69:e3:62:6b:73:43:71:a7:95:c2:85:e8:a0:64:92:5a:b4:87
Signer

.text
Size: 3KB - Virtual size: 2KB

.tex
Size: 1KB - Virtual size: 1KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 25KB - Virtual size: 25KB