88236b9d31a8af59a2a53961ed47bc59_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
88236b9d31a8af59a2a53961ed47bc59_JaffaCakes118
Size 46KB
Sample241102-2dah1axcrd
SHA256 b8248b18907a2b7d3045ba95d84d516f8ac6bcfce72753b2501b9b1f2a89b4e1
MD5 88236b9d31a8af59a2a53961ed47bc59
SHA1 b91cdda90bb69c80e97e435dafd23f96de357292
SHA512 17acd1ea138769ad2ea71308bbb66cde40fd215bda6caa64654bf03d2a8deed5639df921b334c80ece1f03d20cfd038502955073f8c15103c24504a5e5ffddab
SSDEEP 768:RSd3AsrIXEh8WfsztZGBYKu9G/ZyTZj1urLdHjsdwOhme/O2MFn4LXx:HIomsztd2l3lsmOhmyO1Fn49
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

88236b9d31a8af59a2a53961ed47bc59_JaffaCakes118

.exe 46KB

88236b9d31a8af59a2a53961ed47bc59_JaffaCakes118

IMPHASH 09d0478591d4f788cb3e5ea416c25237
SHA256 b8248b18907a2b7d3045ba95d84d516f8ac6bcfce72753b2501b9b1f2a89b4e1
MD5 88236b9d31a8af59a2a53961ed47bc59
SHA1 b91cdda90bb69c80e97e435dafd23f96de357292
SHA512 17acd1ea138769ad2ea71308bbb66cde40fd215bda6caa64654bf03d2a8deed5639df921b334c80ece1f03d20cfd038502955073f8c15103c24504a5e5ffddab
SSDEEP 768:RSd3AsrIXEh8WfsztZGBYKu9G/ZyTZj1urLdHjsdwOhme/O2MFn4LXx:HIomsztd2l3lsmOhmyO1Fn49
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Serial Number

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Timespan

Aug 1, 1996 - Dec 31, 2020

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Serial Number

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Aug 6, 2003 - Aug 5, 2013

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=Qizhi Software (beijing) Co. Ltd,OU=Secure Application Development,O=Qizhi Software (beijing) Co. Ltd,L=Beijing,ST=Beijing,C=CN

Serial Number

61:3b:f8:85:49:64:12:20:7e:cb:70:ac:fa:c6:75:5b

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning

Timespan

Nov 24, 2006 - Nov 23, 2008

Minor OS version

Major OS version

Entry point

47392

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

ndfs

Size

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

nf5s

Size

3KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

h6ff

Size

24KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

bsdr

Size

10KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

vsdyts

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

g54d

Size

512B

Virtual Size

512B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

88236b9d31a8af59a2a53961ed47bc59_JaffaCakes118

PE Signature issue

kernel32

generic