77810bf7476ec8359a568f669dc5c77f_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
77810bf7476ec8359a568f669dc5c77f_JaffaCakes118
Size 205KB
Sample241028-eajaeazfrm
SHA256 ff08a9b051538e1ce286a42d0a066e264cf7592d659d948b533e2b0b615c11fe
MD5 77810bf7476ec8359a568f669dc5c77f
SHA1 383f12f726042bd985acf0e108968d98841c1dc9
SHA512 fa56c96b4c7dbcb3aeb392434ee6c3e3b3905095a6ba50f6dda9e7f000f6f406b7f1f6813ae9afe37fb7b5efde799e9511d3fae0027139eaad48bff2ec861cac
SSDEEP 6144:JMnXKung8io3DmLYK36zG4XmMVjMAlQipGjzsf:Ja7nfio3DsYKIrdVYAtpww
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

77810bf7476ec8359a568f669dc5c77f_JaffaCakes118

.exe 205KB

77810bf7476ec8359a568f669dc5c77f_JaffaCakes118

IMPHASH 115183b1d569f22db4052d9795e97015
SHA256 ff08a9b051538e1ce286a42d0a066e264cf7592d659d948b533e2b0b615c11fe
MD5 77810bf7476ec8359a568f669dc5c77f
SHA1 383f12f726042bd985acf0e108968d98841c1dc9
SHA512 fa56c96b4c7dbcb3aeb392434ee6c3e3b3905095a6ba50f6dda9e7f000f6f406b7f1f6813ae9afe37fb7b5efde799e9511d3fae0027139eaad48bff2ec861cac
SSDEEP 6144:JMnXKung8io3DmLYK36zG4XmMVjMAlQipGjzsf:Ja7nfio3DsYKIrdVYAtpww
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

bc:e0:ba:56:5d:91:30:92:f3:1f:cf:de:39:87:5d:87:1d:26:69:3a

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Sep 15, 2010

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:08:77:5f:00:00:00:00:00:4a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 19, 2010 - Oct 19, 2011

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:159C-A3F7-2570,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:03:dc:f6:00:00:00:00:00:0c

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 25, 2008 - Jul 25, 2011

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:15:08:27:00:00:00:00:00:0c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 25, 2006 - Jan 25, 2017

Minor OS version

Major OS version

Entry point

7247

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetFullPathNameA GetCommandLineW ReplaceFileA FileTimeToLocalFileTime CreateSemaphoreW GetProcessHeaps lstrcmpiA lstrlenA CreateSemaphoreA CreateFileMappingA GlobalGetAtomNameW GlobalFindAtomW CreateDirectoryA RemoveDirectoryA GetEnvironmentVariableA LocalAlloc GetThreadLocale IsBadStringPtrA IsDebuggerPresent GetHandleInformation CreateFileW GetCurrentDirectoryA lstrcmpi GetNumberFormatA CompareStringW GetOEMCP GetModuleHandleA GetVolumeInformationA GetProcAddress GetLogicalDriveStringsW GetCurrentProcessId lstrcmpiW FreeResource GetUserDefaultLCID GetDateFormatW GetSystemTime GetSystemInfo lstrcpynW FindResourceA

user32

GetMenuItemCount FlashWindow GetDlgItemTextW MessageBoxA mouse_event FindWindowA CascadeWindows EndDialog MessageBoxIndirectW EndMenu SetForegroundWindow GetForegroundWindow CreateCaret GetSysColorBrush GetAsyncKeyState GetSysColor RemoveMenu CreateWindowExW CallWindowProcA CreateDesktopA GetWindowTextLengthA GetClassInfoExW CreateAcceleratorTableW wvsprintfA GetDC RegisterClassW wvsprintfW ArrangeIconicWindows MonitorFromPoint CreateDesktopW

gdi32

RemoveFontResourceA GetEnhMetaFilePaletteEntries ExtCreateRegion FixBrushOrgEx GetCharABCWidthsW CreatePen SetPixelFormat CreateDIBitmap

advapi32

RegSaveKeyA RegCreateKeyExW RegReplaceKeyA RegCreateKeyW RegRestoreKeyA RegOpenKeyExA

shell32

SHCreateDirectoryExW

winmm

auxSetVolume joyGetDevCapsW joyReleaseCapture waveOutGetPitch joyGetThreshold mmioSetInfo

Name

.text

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.fwg

Size

1KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.qOkvns

Size

1KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.PlPk

Size

3KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

1KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.EbYnY

Size

1024B

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.FoRmJ

Size

512B

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.nFn

Size

1KB

Virtual Size

209KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

162KB

Virtual Size

162KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

77810bf7476ec8359a568f669dc5c77f_JaffaCakes118

PE Signature issue

kernel32

user32

gdi32

advapi32

shell32

winmm

generic