55f8459c2667b68a3e9dbd66aa29531c_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

55f8459c2667b68a3e9dbd66aa29531c_JaffaCakes118
Size

256KB
MD5

55f8459c2667b68a3e9dbd66aa29531c
SHA1

db114f437461e24382dd86bf8404083401c53559
SHA256

5e82b46b7a5c10744a201e9f91c2e47b77ad0ac27db043353219049f8d004c4a
SHA512

2e12236ea205f3736f7de86a9fe79f58df3082483c23d3859033800e09099cd096dd02cee6c5ed4b17d8e8fa554e6946c6bee675da0a20fbc3cfc23ab3ebbb90
SSDEEP

3072:KWZXeOtl3HfPkzfOwliXnBQMqZFeCd9TQR203gaagtMaFWYSx2PTvA:XX3tl3Hf8SyqmOK28aTMVYS/

Score

1^/10

Malware Config

Signatures

Files

55f8459c2667b68a3e9dbd66aa29531c_JaffaCakes118
.exe windows:5 windows x86 arch:x86

661f00f579b51abf4401656245cd6a2e

Code Sign

18:1d:cf:81:1e:4a:56:56:b2:5c:77:eb:9a:d0:96:be
Certificate

Issuer

CN=534634 inc

Not Before

02/02/2012, 05:24

Not After

31/12/2039, 23:59

Subject

CN=534634 inc

Extended Key Usages

ExtKeyUsageCodeSigning

67:9e:e8:d5:bf:67:3a:47:2f:b3:45:50:4a:5d:0a:89:e5:52:19:07
Signer

Actual PE Digest

67:9e:e8:d5:bf:67:3a:47:2f:b3:45:50:4a:5d:0a:89:e5:52:19:07

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcessHeap
CreateFileW
lstrcatW
GetWindowsDirectoryW
LoadLibraryA
GetProcAddress
GetSystemInfo
AssignProcessToJobObject
BackupRead
BackupWrite
CallNamedPipeW
CloseHandle
CompareStringW
CreateDirectoryExA
CreateEventW
CreateHardLinkW
CreateSemaphoreW
DebugActiveProcess
DefineDosDeviceW
DeleteVolumeMountPointW
EnumSystemLocalesA
FileTimeToLocalFileTime
FindFirstChangeNotificationW
FindFirstFileExA
FindFirstVolumeMountPointW
FindNextVolumeMountPointW
FoldStringA
FreeResource
GetACP
GetCalendarInfoW
GetCommProperties
GetCommandLineW
GetCompressedFileSizeW
GetComputerNameW
GetConsoleAliasExesW
GetConsoleAliasW
GetCurrentProcess
GetDiskFreeSpaceExA
GetDiskFreeSpaceW
GetDriveTypeW
GetEnvironmentVariableA
GetFileAttributesA
GetFileInformationByHandle
GetLocalTime
GetLogicalDrives
GetModuleHandleA
GetNamedPipeInfo
GetPrivateProfileSectionA
GetProfileSectionW
GetShortPathNameA
GetStringTypeExA
GetSystemWindowsDirectoryA
GetTempFileNameA
GetTempPathW
GetThreadSelectorEntry
GetUserDefaultLangID
GetUserDefaultUILanguage
GetVolumeInformationW
GetVolumePathNameA
GlobalAlloc
GlobalFree
GlobalHandle
GlobalUnWire
GlobalUnfix
HeapAlloc
HeapWalk
InitializeCriticalSection
InterlockedExchange
InterlockedIncrement
IsValidLocale
LockFile
Module32Next
MoveFileWithProgressW
OpenJobObjectA
PurgeComm
ReadConsoleOutputA
ReadConsoleOutputCharacterA
ReadFileScatter
ResetEvent
SetCommMask
SetEvent
SetFileAttributesA
SetFilePointerEx
SetInformationJobObject
SetLocaleInfoA
SetPriorityClass
SetThreadIdealProcessor
SetThreadLocale
SetTimeZoneInformation
SetUnhandledExceptionFilter
SetupComm
SystemTimeToFileTime
UnlockFile
WaitForMultipleObjectsEx
WideCharToMultiByte
WriteFileEx
WriteProcessMemory
_lwrite
lstrcmpi
lstrcpyW
lstrcpyn
lstrcpynA

msvcrt

memset

user32

InsertMenuItemW
wsprintfA
AllowSetForegroundWindow
CharLowerA
CharNextA
CharUpperA
ClientToScreen
DdeCreateStringHandleA
DeferWindowPos
DeregisterShellHookWindow
DestroyAcceleratorTable
DialogBoxParamW
EnableScrollBar
EndPaint
EnumClipboardFormats
EnumWindowStationsA
GetActiveWindow
GetAltTabInfo
GetCapture
GetClassLongW
GetClassWord
GetClientRect
GetKeyState
GetKeyboardLayoutList
GetMenuCheckMarkDimensions
GetMenuDefaultItem
GetMenuItemID
GetMenuItemRect
GetMonitorInfoW
GetUserObjectInformationA
GetWindowInfo
GetWindowTextLengthA
GetWindowThreadProcessId
GrayStringW
IsWindowEnabled
LoadCursorA
LoadIconA
LoadKeyboardLayoutW
MoveWindow
NotifyWinEvent
OffsetRect
OpenClipboard
OpenIcon
RealChildWindowFromPoint
RealGetWindowClassA
RealGetWindowClassW
RemovePropA
ScrollDC
SendIMEMessageExW
SendMessageCallbackA
SendMessageW
SetMenuContextHelpId
SetParent
SetProcessWindowStation
SetThreadDesktop
SetUserObjectInformationW
SetWindowPlacement
SetWindowRgn
ShowWindow
SwitchDesktop
ToUnicode
TrackPopupMenu
TranslateMessage
UnhookWinEvent
UnregisterDeviceNotification
VkKeyScanW

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 484B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 222KB - Virtual size: 222KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

661f00f579b51abf4401656245cd6a2e

Code Sign

18:1d:cf:81:1e:4a:56:56:b2:5c:77:eb:9a:d0:96:beCertificate

Extended Key Usages

67:9e:e8:d5:bf:67:3a:47:2f:b3:45:50:4a:5d:0a:89:e5:52:19:07Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

user32

Sections

.text Size: 8KB - Virtual size: 8KB

.data Size: 512B - Virtual size: 484B

.text Size: 222KB - Virtual size: 222KB

.rsrc Size: 20KB - Virtual size: 20KB

.reloc Size: 2KB - Virtual size: 1KB

18:1d:cf:81:1e:4a:56:56:b2:5c:77:eb:9a:d0:96:be
Certificate

67:9e:e8:d5:bf:67:3a:47:2f:b3:45:50:4a:5d:0a:89:e5:52:19:07
Signer

.text
Size: 8KB - Virtual size: 8KB

.data
Size: 512B - Virtual size: 484B

.text
Size: 222KB - Virtual size: 222KB

.rsrc
Size: 20KB - Virtual size: 20KB

.reloc
Size: 2KB - Virtual size: 1KB