5236064fe1c3992a0bb4da5724e10cf0_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

5236064fe1c3992a0bb4da5724e10cf0_JaffaCakes118
Size

1018KB
MD5

5236064fe1c3992a0bb4da5724e10cf0
SHA1

c796944514505b84b6e2300d85411bf315b76dca
SHA256

676ffb11cb18c2e97f848dfbf96771ef7b1077e2250232b432dc794c7ea5bb7a
SHA512

3a3b5dba77d57f91afeb49a0f6e3d96986dd14c984361188c0813c7300eaa93f9b7d46cbd35d79cc7c678ad5d22534474808435534c2f132752a4c06a69d8bd3
SSDEEP

24576:aCTp7n8rwvjoJSxMz0t+9/l0bcAoYwV1i7qHMhAwf6W:aApzfjo0x0ybRoYqi2H9W

Score

1^/10

Malware Config

Signatures

Files

5236064fe1c3992a0bb4da5724e10cf0_JaffaCakes118
.exe windows:4 windows x86 arch:x86

baa93d47220682c04d92f7797d9224ce

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4d:62:90:e5:8c:54:f0:f1:eb:17:34:1a:13:10:e6:a4
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

30/09/2010, 00:00

Not After

01/01/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:a0:6d:56:7f:a8:8e:8e:66:d5:f5:04:4b:a0:7f:c5
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

03/12/2010, 00:00

Not After

19/01/2014, 23:59

Subject

CN=StorageCraft Technology Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=StorageCraft Technology Corporation,L=Draper,ST=Utah,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

31:1a:b4:73:99:9d:09:2c:5b:23:11:95:58:a2:5f:b9:90:74:be:c4
Signer

Actual PE Digest

31:1a:b4:73:99:9d:09:2c:5b:23:11:95:58:a2:5f:b9:90:74:be:c4

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcpy

comctl32

InitCommonControls

Sections

Size: 96KB - Virtual size: 264KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 4KB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

mxnhvtzi
Size: 892KB - Virtual size: 896KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

obxanfvh
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

baa93d47220682c04d92f7797d9224ce

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

4d:62:90:e5:8c:54:f0:f1:eb:17:34:1a:13:10:e6:a4Certificate

Extended Key Usages

Key Usages

61:0c:12:06:00:00:00:00:00:1bCertificate

Key Usages

08:a0:6d:56:7f:a8:8e:8e:66:d5:f5:04:4b:a0:7f:c5Certificate

Extended Key Usages

Key Usages

31:1a:b4:73:99:9d:09:2c:5b:23:11:95:58:a2:5f:b9:90:74:be:c4Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

comctl32

Sections

Size: 96KB - Virtual size: 264KB

.rsrc Size: 4KB - Virtual size: 1KB

.idata Size: 4KB - Virtual size: 8KB

Size: 4KB - Virtual size: 1.1MB

mxnhvtzi Size: 892KB - Virtual size: 896KB

obxanfvh Size: 4KB - Virtual size: 8KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

4d:62:90:e5:8c:54:f0:f1:eb:17:34:1a:13:10:e6:a4
Certificate

61:0c:12:06:00:00:00:00:00:1b
Certificate

08:a0:6d:56:7f:a8:8e:8e:66:d5:f5:04:4b:a0:7f:c5
Certificate

31:1a:b4:73:99:9d:09:2c:5b:23:11:95:58:a2:5f:b9:90:74:be:c4
Signer

.rsrc
Size: 4KB - Virtual size: 1KB

.idata
Size: 4KB - Virtual size: 8KB

mxnhvtzi
Size: 892KB - Virtual size: 896KB

obxanfvh
Size: 4KB - Virtual size: 8KB