774c04e8f0f12b89694173096f931fb7_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

774c04e8f0f12b89694173096f931fb7_JaffaCakes118
Size

700KB
MD5

774c04e8f0f12b89694173096f931fb7
SHA1

0b9fe97c7457b49acc840f9d09202b0339aeb547
SHA256

d9cea51ae23673bdce6bd0f432448aea6f9101f4c3e802236986f6cd77a2f355
SHA512

3a932eb3762f81461d03b8170ebf7f66dee4c1a3400e6d9cb1b92154fe2d87fbb1edfd47136d627211a1cc280f31ebbc2254b68e3a6c5c97f20f2c31f959d1ee
SSDEEP

12288:j/xNa+JQbp3d45lI0ekZe91BHVVPfY17wnRofK7LP5/8a5YkW97rGMOHH4kSt:bubpNUlnv0zRVliPKJkLkmBOHH4kSt

Score

1^/10

Malware Config

Signatures

Files

774c04e8f0f12b89694173096f931fb7_JaffaCakes118
.exe windows:4 windows x86 arch:x86

63ca4d191edb38b3cbf98e1f5c624e16

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01-05-2012 00:00

Not After

31-12-2012 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

01
Certificate

Issuer

CN=Pike,OU=Development,O=PBCgroup,L=Belgrade,ST=Serbia,C=GB,1.2.840.113549.1.9.1=#0c10736d3234393540676d61696c2e636f6d

Not Before

09-05-2012 14:01

Not After

09-05-2013 14:01

Subject

CN=PikeUE,OU=Development,O=PBCgroup,L=Belgrade,ST=Serbia,C=GB,1.2.840.113549.1.9.1=#0c10736d3234393540676d61696c2e636f6d

e0:aa:eb:c0:c6:88:1c:2f:a6:ff:5d:92:21:9e:d7:27:59:92:9c:ff
Signer

Actual PE Digest

e0:aa:eb:c0:c6:88:1c:2f:a6:ff:5d:92:21:9e:d7:27:59:92:9c:ff

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetFileAttributesA
GetFileAttributesW
GetModuleFileNameW
Sleep
DeleteFileW
WaitForDebugEvent
ContinueDebugEvent
CreateProcessA
GetCommandLineA
GetStartupInfoA
CloseHandle
WriteFile
CreateFileA
WaitForSingleObject
CreateThread
SetFileAttributesW
GetProcAddress
LoadLibraryA
FindClose
OutputDebugStringA
LCMapStringA
GetOEMCP
GetACP
GetCPInfo
GetStringTypeW
GetLastError
MultiByteToWideChar
HeapFree
WideCharToMultiByte
GetModuleHandleA
GetVersion
ExitProcess
HeapAlloc
TerminateProcess
GetCurrentProcess
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
RtlUnwind
GetStringTypeA
LCMapStringW

ole32

CoCreateInstance
CoInitialize

shell32

SHGetSpecialFolderPathW

Sections

.text
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 667KB - Virtual size: 666KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

63ca4d191edb38b3cbf98e1f5c624e16

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:edCertificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

01Certificate

e0:aa:eb:c0:c6:88:1c:2f:a6:ff:5d:92:21:9e:d7:27:59:92:9c:ffSigner

Headers

File Characteristics

Imports

kernel32

ole32

shell32

Sections

.text Size: 27KB - Virtual size: 27KB

.rsrc Size: 667KB - Virtual size: 666KB

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

01
Certificate

e0:aa:eb:c0:c6:88:1c:2f:a6:ff:5d:92:21:9e:d7:27:59:92:9c:ff
Signer

.text
Size: 27KB - Virtual size: 27KB

.rsrc
Size: 667KB - Virtual size: 666KB