530edd7dfcdf9b6a3ae562cd26fe3cf3_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

530edd7dfcdf9b6a3ae562cd26fe3cf3_JaffaCakes118
Size

296KB
MD5

530edd7dfcdf9b6a3ae562cd26fe3cf3
SHA1

fe237358e447a522f72c79f6d9453550286fc6c2
SHA256

d2703a4aaf2ae3afa91324a27dbeafb2ab7ab2201a7cac95d4257846333e263e
SHA512

cb68b015df2b46bec5a81493bcdbf4b138cdf5224b79799bc2da8914f920b2a04ca69ec19d3c997aba539c2dfbc9168feb483d7e351975aef2135dcd9a2bc496
SSDEEP

3072:n0wSAyaLy+Qzz1b5IACzOHdkrg9RflTJZcFXkzjFjy1FN3gqWwOcFXkzjFjy1FNp:JSMqBbVHdkWt/cFkRYFN8cFkRYFNX5

Score

1^/10

Malware Config

Signatures

Files

530edd7dfcdf9b6a3ae562cd26fe3cf3_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

2f6233e796cd227796d2e07cee797cc1

Code Sign

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

10:dc:b8:e8:e4:cc:ba:82:87:ca:3e:7d:2c:ab:6b:80
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

31/01/2008, 05:39

Not After

30/01/2009, 05:39

Subject

CN=Mediaclick,OU=Software Development Department,O=Mediaclick,L=Gangnam-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

06:9d:2e:f2:c3:36:35:cf:ff:f3:e6:53:b3:57:97:6d:d0:41:bc:0d
Signer

Actual PE Digest

06:9d:2e:f2:c3:36:35:cf:ff:f3:e6:53:b3:57:97:6d:d0:41:bc:0d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

wininet

DeleteUrlCacheEntry

urlmon

URLDownloadToFileA

kernel32

GetShortPathNameA
WideCharToMultiByte
FreeLibrary
SizeofResource
LoadResource
FindResourceA
GetLastError
LoadLibraryExA
lstrcmpiA
lstrcpynA
IsDBCSLeadByte
HeapDestroy
GetProcAddress
LoadLibraryA
lstrcpyA
lstrcatA
DeleteFileA
GetTempFileNameA
GetTempPathA
CloseHandle
WriteFile
CreateFileA
TerminateProcess
lstrcmpA
FlushInstructionCache
GetCurrentProcess
GetCurrentThreadId
GlobalUnlock
GlobalLock
GlobalAlloc
Sleep
WinExec
GetPrivateProfileIntA
GetPrivateProfileStringA
lstrlenA
SetEndOfFile
ReadFile
FlushFileBuffers
SetStdHandle
IsBadCodePtr
IsBadReadPtr
SetFilePointer
GetStringTypeW
GetStringTypeA
SetUnhandledExceptionFilter
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
UnhandledExceptionFilter
TlsGetValue
SetLastError
TlsFree
TlsAlloc
HeapSize
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
LCMapStringW
LCMapStringA
ExitProcess
GetOEMCP
GetACP
GetCPInfo
RaiseException
GetVersion
GetCommandLineA
ExitThread
TlsSetValue
CreateThread
ResumeThread
RtlUnwind
GetLocalTime
MultiByteToWideChar
lstrlenW
InterlockedDecrement
EnterCriticalSection
InterlockedIncrement
LeaveCriticalSection
HeapAlloc
DeleteCriticalSection
InitializeCriticalSection
GetModuleFileNameA
DisableThreadLibraryCalls
CompareStringA
CompareStringW
SetEnvironmentVariableA
HeapFree
InterlockedExchange
GetSystemTime
GetTimeZoneInformation
GetFileAttributesA
HeapReAlloc
LocalFree

user32

ShowWindow
SendMessageA
GetWindow
GetFocus
GetWindowRect
GetSysColor
CharNextA
CharUpperA
wsprintfA
IsWindow
DestroyWindow
GetClientRect
LoadStringA
BeginPaint
FindWindowExA
GetWindowTextLengthA
GetWindowTextA
SetWindowTextA
RegisterWindowMessageA
GetDlgItem
InvalidateRgn
InvalidateRect
SetCapture
ReleaseCapture
GetClassInfoExA
LoadCursorA
RegisterClassExA
CreateAcceleratorTableA
GetParent
GetClassNameA
RedrawWindow
SetWindowPos
GetDesktopWindow
FillRect
EndPaint
GetDC
ReleaseDC
IsChild
SetFocus
CallWindowProcA
GetWindowLongA
DefWindowProcA
SetWindowLongA
CreateWindowExA

gdi32

GetStockObject
GetObjectA
CreateSolidBrush
CreateCompatibleBitmap
CreateCompatibleDC
SelectObject
BitBlt
DeleteDC
GetDeviceCaps
DeleteObject

advapi32

RegQueryValueExA
RegEnumValueA
RegQueryInfoKeyA
RegEnumKeyExA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCreateKeyExA
RegCloseKey
RegSetValueExA

ole32

CoCreateFreeThreadedMarshaler
CoTaskMemFree
CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance
OleUninitialize
OleInitialize
CreateStreamOnHGlobal
OleLockRunning
CoUninitialize
CoInitialize
CLSIDFromProgID
CLSIDFromString
StringFromCLSID

oleaut32

VariantCopy
VariantChangeType
OleCreateFontIndirect
SysAllocStringLen
SafeArrayCreateVector
SafeArrayAccessData
SafeArrayUnaccessData
SysStringByteLen
SysAllocStringByteLen
VariantInit
VariantClear
VarUI4FromStr
SysFreeString
SysAllocString
LoadTypeLi
RegisterTypeLi
LoadRegTypeLi
SysStringLen

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 80KB - Virtual size: 77KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 135KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 176KB - Virtual size: 173KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2f6233e796cd227796d2e07cee797cc1

Code Sign

0aCertificate

Extended Key Usages

Key Usages

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

10:dc:b8:e8:e4:cc:ba:82:87:ca:3e:7d:2c:ab:6b:80Certificate

Extended Key Usages

06:9d:2e:f2:c3:36:35:cf:ff:f3:e6:53:b3:57:97:6d:d0:41:bc:0dSigner

Headers

File Characteristics

Imports

wininet

urlmon

kernel32

user32

gdi32

advapi32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 80KB - Virtual size: 77KB

.rdata Size: 12KB - Virtual size: 10KB

.data Size: 8KB - Virtual size: 135KB

.rsrc Size: 176KB - Virtual size: 173KB

.reloc Size: 12KB - Virtual size: 8KB

0a
Certificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

10:dc:b8:e8:e4:cc:ba:82:87:ca:3e:7d:2c:ab:6b:80
Certificate

06:9d:2e:f2:c3:36:35:cf:ff:f3:e6:53:b3:57:97:6d:d0:41:bc:0d
Signer

.text
Size: 80KB - Virtual size: 77KB

.rdata
Size: 12KB - Virtual size: 10KB

.data
Size: 8KB - Virtual size: 135KB

.rsrc
Size: 176KB - Virtual size: 173KB

.reloc
Size: 12KB - Virtual size: 8KB