neshta | b72f98f14afe9299775ed2da98a77bd7_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

b72f98f14afe9299775ed2da98a77bd7_JaffaCakes118
Size

313KB
MD5

b72f98f14afe9299775ed2da98a77bd7
SHA1

0210f27fbebfadf3a52d06222e50ce596ed2db58
SHA256

a92ed67fe05072b2518ca382111a82e236e4bd937f3443952db9af6148e738c7
SHA512

419f465cca4f411bf2f7f0fc8a148af74bf415c768f88509deb40dbb82e76478be144fe7ced9e13771643fd84caa3631dbe4734372bcae31c6192a8f83283a74
SSDEEP

3072:dQ4omAhLjkbWrJBj/yMEwTMu8IGy6YQ4omTQ4ompr85Cxr85CbQ4omF:KmkfmIBjKw6Ry+mkmF9N9cmF

Score

10^/10

neshta

Malware Config

Signatures

Detect Neshta payload 1 IoCs

resource	yara_rule
sample	family_neshta

Neshta family
neshta

Files

b72f98f14afe9299775ed2da98a77bd7_JaffaCakes118
.exe windows:4 windows x86 arch:x86

bf8ce57e282744ed467154a2029db1a5

Code Sign

10:d3:a0:f2:5f:fb:ad:bd:49:41:ce:3c:27:00:3b:e0
Certificate

Issuer

CN=Root Agency

Not Before

31-07-2012 23:45

Not After

31-12-2039 23:59

Subject

CN=safebrowsing.mozilla.org

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01-05-2012 00:00

Not After

31-12-2012 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

85:9f:59:6b:4c:51:72:72:87:32:f6:60:1c:0b:46:18:70:4a:dd:98
Signer

Actual PE Digest

85:9f:59:6b:4c:51:72:72:87:32:f6:60:1c:0b:46:18:70:4a:dd:98

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateEventA
SetEvent
GetCurrentProcess
GetProcAddress
LoadLibraryA
VirtualProtect
LockResource
LoadResource
FindResourceA
LocalFree
MapViewOfFile
CreateFileMappingA
ExitThread
ResetEvent
LocalAlloc

user32

GetClassInfoExA
PostMessageA
GetForegroundWindow

ntdll

LdrFindEntryForAddress
LdrGetDllHandleEx

Sections

.text
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 666B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 76KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bf8ce57e282744ed467154a2029db1a5

Code Sign

10:d3:a0:f2:5f:fb:ad:bd:49:41:ce:3c:27:00:3b:e0Certificate

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:edCertificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

85:9f:59:6b:4c:51:72:72:87:32:f6:60:1c:0b:46:18:70:4a:dd:98Signer

Headers

File Characteristics

Imports

kernel32

user32

ntdll

Sections

.text Size: 20KB - Virtual size: 17KB

.rdata Size: 4KB - Virtual size: 666B

.data Size: - Virtual size: 8B

.rsrc Size: 76KB - Virtual size: 73KB

.reloc Size: 4KB - Virtual size: 60KB

10:d3:a0:f2:5f:fb:ad:bd:49:41:ce:3c:27:00:3b:e0
Certificate

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

85:9f:59:6b:4c:51:72:72:87:32:f6:60:1c:0b:46:18:70:4a:dd:98
Signer

.text
Size: 20KB - Virtual size: 17KB

.rdata
Size: 4KB - Virtual size: 666B

.data
Size: - Virtual size: 8B

.rsrc
Size: 76KB - Virtual size: 73KB

.reloc
Size: 4KB - Virtual size: 60KB