JaffaCakes118_77ea7060d4568c866b6e52220484eea5

Sharing

Copy URL

Twitter E-mail

General

Target

JaffaCakes118_77ea7060d4568c866b6e52220484eea5
Size

187KB
MD5

77ea7060d4568c866b6e52220484eea5
SHA1

118a649849b53c2c5b6e8c19d8e19bef50bf32ab
SHA256

f0bdf8df1016d4b76df491a7ff38909e1e961cd45232d7ae976a55696e9a7e9c
SHA512

93d16bd29008998615b3207007211f4867d3735abb54be14b9c585a46e12c7a831f6de0ca7add8eca127c5ce7c44b56699c9712ca113d72304d8556b264ae638
SSDEEP

3072:CT8ElSg4GHhNLuPPx49TVvrvuDCvZNz174r:FNgBHh9YCVSSZf0

Score

1^/10

Malware Config

Signatures

Files

JaffaCakes118_77ea7060d4568c866b6e52220484eea5
.exe windows:4 windows x86 arch:x86

0e83646bfcb6d42031c806ba045764ed

Code Sign

5b:be:a6:af:c9:41:b1:ab:40:d3:fb:92:00:39:36:2a
Certificate

Issuer

CN=AIJRQTPHNHRQRXSYJZNZMDZDFPEWFOXWORLOLDLMUQCUCZLGUZDSLMUTHGGMBWHWWLJSGOXEHBJCICYKYYZDAOKZJNTCIWSRZTYVAMCNUWYGMWPPKNOCZLTIDOIXOJVKXQIWERTJXESAKJNTUEOQOSNAGOYJQQFVUBXWUKLGLARMGAPKRHAXNGFUNLUAEICFTXIDIHOHCJFTXSNTSGIEEKAGSEKQFNQRZYNZYIGISCADRRUROFZZIXZLQOPCJQQVPUUBFALVBAACKPPQZHXWJXZGDIJKSOSBXCPYFDVZBTJGNNAVRPGSFYOBACCVZPIKCHUPRAWMOXPKXZVCKZLJHZCBHLMQHJQLNUJAUGWVNYMLAVPYZIFZOJUZVTIJKARMLWTIGZXCVIBMWJTLGKNUMYNFQLXSOBDOFTNYJPTBNIRUYHJKCVSFDUBYQSQMNIQHGORGWAADODYSIRMIJEIVANXVYUIQQELWYHJZDNEJBXTVPCSHAYEHHEHHOSAITIRISWCXYVIMAQHWVLPBZMKOMCJJPLZWFWGFBCQYUZLXPGARRAKBHBKQVBXUEWVRXJTTNTZGMOGQXQSHHPFIXWXRYJOXLUMIJSTXOLNCNJHJDMIXLGWRYAVBCNUUQXCRLHJEUTVWWVWLMLEWIPXKMNLIZQSAWUBNSVQVUDVDAQBXDCXPSNVPOHGBWBHAMAEAFLKSFWQSBWSJLXIVWLTZKBDCQRJTSXJJMTFJSITLOCNEPEPIRBSXEQDLNSKWWWAYPRKZZPXJOHVIAHDCMPJJBPPEMVSQHBQIGQDJSVCRSTWKZISEEOHAHNGQWALBJRBENIHBSYPUGGRTYLGYDAUFEUZFQULSMSLJDAPESXBEUYZGHOBTJHZXZTANFAJXCCGXHGNPPKGNPLIOMQRFJERUBSWHPYROQTCXUBISEGJRLQBWZMYCCXNDTTIMJFOFQJZUWUBRHZVPOZHDHTZGEBAWMAKDNZBEQREYJIOGYEIMVFXYACDUPRJPRKMLRRXIDEFCPVKXZFWNPOPMRBEWBDNQUVEVYFSEUJYYLXZSLKQHSOVQWBAXQHGVHBKUZXVYEQKMJQMLIAHIPHUZHKXKAJEVTUIBYMJOZIZUGKVLQFOLGDNQPJIBLAOVQPLKOZFMWNKEOCTVMZQNCWWNLBDSQGPSQAMXBZCWNLPAIXUHYHVQDUIDPOKIVNDBGKMRGJLQUZSXCOFGCBXCZMIPUWNCVSXAFDTBKNOFIEJOWACRFZSFPYATWUBHZBINEJXNJEMTBTGVIWHGKTOOSSHCPDAJDGQZVGTRNLYCTLNVNWLJXYXWIOVSWOPZSIXRYVNHTWQQHYLRDIZZZBPAFTELPRGXPVYJHBPINLXOOSSUIZCUYNSYNZORQYUAHOHNQSSXTNXPOHGRXWSBBNOXZHBOZUGMSXJIUPXGYWOEFYEYANRUSJVEVENUPNZMLNHOSJKTCQPKMZAMNUMOHDKGXLMVNIPMMMZRFOVAVMOZMNOGSAMSEVNUNMKTUJZYLIFTHQYSFHRJFRTIKYTDVJQPMXLHLPHRKZLPVAYUVOBNTLACZQELSPNPGWOTPZBNAUYQWZEFWZNGHQXYKQLWIGGYRUMGLJYMMLTWKRJFZWSWXCHMAXZIGYCWFRTLCNBSNCT

Not Before

19-12-2012 05:21

Not After

31-12-2039 23:59

Subject

CN=AIJRQTPHNHRQRXSYJZNZMDZDFPEWFOXWORLOLDLMUQCUCZLGUZDSLMUTHGGMBWHWWLJSGOXEHBJCICYKYYZDAOKZJNTCIWSRZTYVAMCNUWYGMWPPKNOCZLTIDOIXOJVKXQIWERTJXESAKJNTUEOQOSNAGOYJQQFVUBXWUKLGLARMGAPKRHAXNGFUNLUAEICFTXIDIHOHCJFTXSNTSGIEEKAGSEKQFNQRZYNZYIGISCADRRUROFZZIXZLQOPCJQQVPUUBFALVBAACKPPQZHXWJXZGDIJKSOSBXCPYFDVZBTJGNNAVRPGSFYOBACCVZPIKCHUPRAWMOXPKXZVCKZLJHZCBHLMQHJQLNUJAUGWVNYMLAVPYZIFZOJUZVTIJKARMLWTIGZXCVIBMWJTLGKNUMYNFQLXSOBDOFTNYJPTBNIRUYHJKCVSFDUBYQSQMNIQHGORGWAADODYSIRMIJEIVANXVYUIQQELWYHJZDNEJBXTVPCSHAYEHHEHHOSAITIRISWCXYVIMAQHWVLPBZMKOMCJJPLZWFWGFBCQYUZLXPGARRAKBHBKQVBXUEWVRXJTTNTZGMOGQXQSHHPFIXWXRYJOXLUMIJSTXOLNCNJHJDMIXLGWRYAVBCNUUQXCRLHJEUTVWWVWLMLEWIPXKMNLIZQSAWUBNSVQVUDVDAQBXDCXPSNVPOHGBWBHAMAEAFLKSFWQSBWSJLXIVWLTZKBDCQRJTSXJJMTFJSITLOCNEPEPIRBSXEQDLNSKWWWAYPRKZZPXJOHVIAHDCMPJJBPPEMVSQHBQIGQDJSVCRSTWKZISEEOHAHNGQWALBJRBENIHBSYPUGGRTYLGYDAUFEUZFQULSMSLJDAPESXBEUYZGHOBTJHZXZTANFAJXCCGXHGNPPKGNPLIOMQRFJERUBSWHPYROQTCXUBISEGJRLQBWZMYCCXNDTTIMJFOFQJZUWUBRHZVPOZHDHTZGEBAWMAKDNZBEQREYJIOGYEIMVFXYACDUPRJPRKMLRRXIDEFCPVKXZFWNPOPMRBEWBDNQUVEVYFSEUJYYLXZSLKQHSOVQWBAXQHGVHBKUZXVYEQKMJQMLIAHIPHUZHKXKAJEVTUIBYMJOZIZUGKVLQFOLGDNQPJIBLAOVQPLKOZFMWNKEOCTVMZQNCWWNLBDSQGPSQAMXBZCWNLPAIXUHYHVQDUIDPOKIVNDBGKMRGJLQUZSXCOFGCBXCZMIPUWNCVSXAFDTBKNOFIEJOWACRFZSFPYATWUBHZBINEJXNJEMTBTGVIWHGKTOOSSHCPDAJDGQZVGTRNLYCTLNVNWLJXYXWIOVSWOPZSIXRYVNHTWQQHYLRDIZZZBPAFTELPRGXPVYJHBPINLXOOSSUIZCUYNSYNZORQYUAHOHNQSSXTNXPOHGRXWSBBNOXZHBOZUGMSXJIUPXGYWOEFYEYANRUSJVEVENUPNZMLNHOSJKTCQPKMZAMNUMOHDKGXLMVNIPMMMZRFOVAVMOZMNOGSAMSEVNUNMKTUJZYLIFTHQYSFHRJFRTIKYTDVJQPMXLHLPHRKZLPVAYUVOBNTLACZQELSPNPGWOTPZBNAUYQWZEFWZNGHQXYKQLWIGGYRUMGLJYMMLTWKRJFZWSWXCHMAXZIGYCWFRTLCNBSNCT

Extended Key Usages

ExtKeyUsageCodeSigning

56:fa:10:10:2c:f0:ef:09:38:db:8c:da:6d:c9:e6:85:fc:09:38:0a
Signer

Actual PE Digest

56:fa:10:10:2c:f0:ef:09:38:db:8c:da:6d:c9:e6:85:fc:09:38:0a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualAlloc
GetShortPathNameW
GetShortPathNameA
GetVersionExW
SetFileAttributesW
SetFileAttributesA
GetFileAttributesW
GetFileAttributesA
GetCurrentDirectoryW
GetCurrentDirectoryA
GetStartupInfoA
GetModuleHandleA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
FindClose
SetCurrentDirectoryA
SetCurrentDirectoryW
WideCharToMultiByte
MultiByteToWideChar
GetVersionExA
lstrlenW
GetLastError
GetProcAddress
FindFirstFileA
FindFirstFileW
FindNextFileA
FindNextFileW

gdi32

GetStockObject
RealizePalette
SelectPalette
CreateCompatibleDC
GetObjectA
CreateDIBitmap
GetPaletteEntries
DeleteDC
SetPaletteEntries
ResizePalette
GetSystemPaletteEntries
SetSystemPaletteUse
GetDeviceCaps
CreateCompatibleBitmap
BitBlt
CreatePalette
CreateSolidBrush
SelectObject
DeleteObject
SetBkMode
SetTextColor
GetLayout
StretchDIBits
SetLayout

msvcrt

_XcptFilter
_cexit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
_exit
__p__fmode
__set_app_type
_except_handler3
_controlfp
atoi
_c_exit
wcscpy
wcslen
isdigit
isalnum
isspace
_purecall
calloc
rand
floor
_CIacos
strstr
exit
_ftol
fopen
fclose
_strnicmp
realloc
free
malloc
sprintf
_itoa
sscanf
_ltoa
__p__commode
memmove
atol

advapi32

RegOpenKeyW
GetTrusteeNameA
LsaEnumeratePrivilegesOfAccount
BuildTrusteeWithObjectsAndSidA
ImpersonateAnonymousToken
GetEffectiveRightsFromAclA
CreateServiceA
SystemFunction013
GetSecurityDescriptorControl
UninstallApplication
AccessCheckAndAuditAlarmW
AdjustTokenGroups
SetEntriesInAuditListW
LsaOpenSecret
LsaEnumeratePrivileges
RegLoadKeyA
ObjectOpenAuditAlarmA
GetSidSubAuthorityCount
CryptGetDefaultProviderA
LookupPrivilegeNameW
AreAllAccessesGranted
LsaDeleteTrustedDomain
SystemFunction022
SystemFunction031
SetPrivateObjectSecurityEx
LsaICLookupSids
ClearEventLogA
RegReplaceKeyW
SetEntriesInAccessListW
QueryUsersOnEncryptedFile
ElfReadEventLogA
RegRestoreKeyW
QueryServiceObjectSecurity
QueryAllTracesW
CryptEnumProviderTypesW
AddAuditAccessObjectAce
LsaSetTrustedDomainInfoByName
ImpersonateSelf
SystemFunction015
LsaSetSecret
GetNumberOfEventLogRecords
SetSecurityInfoExW
RegSetValueW
OpenServiceW
BuildExplicitAccessWithNameA
SetSecurityInfoExA
ElfCloseEventLog
InitializeAcl
EqualPrefixSid
GetSecurityInfo
SetEntriesInAclA
IsValidSid
RegConnectRegistryA
RegQueryValueW
OpenSCManagerA
CryptGetHashParam
DeleteService
LsaQueryTrustedDomainInfo
SetSecurityDescriptorRMControl
SetAclInformation
LsaCreateTrustedDomainEx
SetFileSecurityW
LsaOpenTrustedDomain
ChangeServiceConfigA
QueryRecoveryAgentsOnEncryptedFile
GetSecurityDescriptorRMControl
AdjustTokenPrivileges
ElfChangeNotify
LsaGetSystemAccessAccount
SystemFunction004
CryptHashData
LogonUserW
QueryServiceConfigW
RegisterServiceCtrlHandlerExW
DuplicateTokenEx
SystemFunction009
CreateServiceW
LsaRetrievePrivateData
LsaLookupNames
OpenTraceA
PrivilegeCheck
DeregisterEventSource
RegDeleteValueW
ControlTraceA
ElfNumberOfRecords
SystemFunction001
AddAccessAllowedAce
SystemFunction033
StartServiceW
GetFileSecurityA
RegReplaceKeyA
SetTraceCallback
ElfRegisterEventSourceW
ElfOldestRecord
RegOpenKeyA
RegOpenKeyExA
RegCloseKey
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegQueryValueA

shell32

ShellAboutA

comctl32

InitCommonControlsEx

Sections

.text
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 103KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0e83646bfcb6d42031c806ba045764ed

Code Sign

5b:be:a6:af:c9:41:b1:ab:40:d3:fb:92:00:39:36:2aCertificate

Extended Key Usages

56:fa:10:10:2c:f0:ef:09:38:db:8c:da:6d:c9:e6:85:fc:09:38:0aSigner

Headers

File Characteristics

Imports

kernel32

gdi32

msvcrt

advapi32

shell32

comctl32

Sections

.text Size: 43KB - Virtual size: 43KB

.data Size: 103KB - Virtual size: 103KB

.rsrc Size: 27KB - Virtual size: 26KB

.reloc Size: 1KB - Virtual size: 1KB

5b:be:a6:af:c9:41:b1:ab:40:d3:fb:92:00:39:36:2a
Certificate

56:fa:10:10:2c:f0:ef:09:38:db:8c:da:6d:c9:e6:85:fc:09:38:0a
Signer

.text
Size: 43KB - Virtual size: 43KB

.data
Size: 103KB - Virtual size: 103KB

.rsrc
Size: 27KB - Virtual size: 26KB

.reloc
Size: 1KB - Virtual size: 1KB