JaffaCakes118_4ac0c476330b28bff54703b4176011d0

Sharing

Copy URL

Twitter E-mail

General

Target

JaffaCakes118_4ac0c476330b28bff54703b4176011d0
Size

235KB
MD5

4ac0c476330b28bff54703b4176011d0
SHA1

2123a25ae2c4fd6f92b5c6307701e102f4b1ad3a
SHA256

135988bdd11fc127c354e283af0fac5e908ab91a9939d01dd089da354c311a91
SHA512

0b3c7c101dbab5be1bcffb5f93c420f2faa69572a0a20a7f925ca822181854c0b280dc9527a47f6f1f7794fd858a4f97ea673d3b55f449e0419831aeb82e425e
SSDEEP

6144:UKP3AAe679MuCGA04izCqmseHPWditiXIKfftNo:UK4ZIMuf4iCBvn84K96

Score

1^/10

Malware Config

Signatures

Files

JaffaCakes118_4ac0c476330b28bff54703b4176011d0
.exe windows:4 windows x86 arch:x86

0e593ac12d661f8ad7f0180465be632d

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:94:d7:39:bc:82:c7:14:9e:be:00:e2:c8:d7:be:f6
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

18-05-2010 00:00

Not After

16-02-2011 23:59

Subject

CN=Trend Micro\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=RD,O=Trend Micro\, Inc.,L=Taipei,ST=Taiwan,C=TW

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21-05-2009 00:00

Not After

20-05-2019 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

f7:74:eb:78:e2:f4:5b:06:34:11:c7:47:48:a3:d1:d9:71:5f:f2:df
Signer

Actual PE Digest

f7:74:eb:78:e2:f4:5b:06:34:11:c7:47:48:a3:d1:d9:71:5f:f2:df

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

IsBadCodePtr
GetProcessHeaps
IsBadWritePtr
lstrlenW
GetEnvironmentStringsW
DisconnectNamedPipe
FatalAppExitW
FatalAppExitA
GetLogicalDriveStringsW
InitializeCriticalSection
GetDiskFreeSpaceW
TlsAlloc
LoadLibraryA
GetSystemDirectoryA
BeginUpdateResourceW
SetUnhandledExceptionFilter
GetModuleHandleW
CopyFileExA
GetVolumeInformationW
GetLongPathNameA
SetCalendarInfoA
FindResourceW
ReplaceFileA
GetDateFormatW
GetEnvironmentVariableA
GetNumberFormatW
GetTempFileNameW
FindAtomW
GetVolumeInformationA
GetLogicalDrives
LocalFree
GetProcessHeap
GetACP
GetCurrentDirectoryA
MulDiv
GetUserDefaultLangID
GetLastError
GetLongPathNameW
EnumTimeFormatsA
EnumCalendarInfoW
CreateNamedPipeW
HeapCreate
GetLocaleInfoA
GetSystemDefaultLangID
FileTimeToSystemTime
LoadLibraryW
GetShortPathNameW
GetUserDefaultLCID
GetWindowsDirectoryA
GetThreadPriority
GetThreadLocale
GetTickCount
RemoveDirectoryW
GetTempFileNameA
GlobalAlloc
lstrcpynA
lstrcmpiW
GetTimeFormatA
lstrcmp
ReadDirectoryChangesW
OpenMutexW
GetFileAttributesW
GetShortPathNameA
CompareFileTime
EnumCalendarInfoA
EnumDateFormatsW
GetComputerNameA
GlobalGetAtomNameW
lstrcpyW
GetCurrentProcess
IsBadStringPtrA
OpenFile
GetLogicalDriveStringsA
GetVersionExA
MoveFileW
SystemTimeToFileTime
GetCalendarInfoA
GetProcAddress
GetOEMCP
SleepEx
SetErrorMode
FreeLibrary
SetCurrentDirectoryW
lstrcpyA
GetCalendarInfoW
lstrcpyn
SetEvent
RaiseException
GetWindowsDirectoryW
ReplaceFileW
SetCalendarInfoW
BeginUpdateResourceA
DuplicateHandle
lstrcmpiA
lstrcat

user32

SetWindowPos
IsWindow
InsertMenuItemA
WinHelpW
EndDialog
CreateDialogIndirectParamA
SendDlgItemMessageW
wvsprintfW
GetCaretPos
MessageBeep
ShowWindow
ActivateKeyboardLayout
OpenClipboard
GetClassInfoExW
GetMessageW
EndMenu
ShowCursor
GetTopWindow
LoadImageA
SetDlgItemInt
ShowCaret
DialogBoxParamA
CharLowerW
DestroyIcon
PostMessageW
FindWindowA
mouse_event
DialogBoxParamW
SetForegroundWindow
CreateDialogIndirectParamW
CharNextA
GetMenuItemInfoW

shell32

DuplicateIcon
ShellExecuteExA
StrStrIW
SHBrowseForFolder
SHGetDiskFreeSpaceExA
SHGetFolderPathA
StrChrW
StrRChrIW
StrStrW
FreeIconList
SHGetDiskFreeSpaceA
ExtractAssociatedIconA
SHCreateDirectoryExW

ole32

CoDosDateTimeToFileTime
BindMoniker
CoGetClassObject
CreateFileMoniker
CoGetCurrentProcess
CoUninitialize

oleaut32

VarUI1FromDisp
SafeArrayCopy
VarBstrFromUI1
VarSub
VarImp
SafeArrayGetElement
RegisterActiveObject

opengl32

glRasterPos2iv
glRenderMode
glTexCoord1sv
glGetPointerv
GlmfInitPlayback
glPixelMapuiv
glColor3bv

ws2_32

WSAGetLastError
WSASend
setsockopt
gethostbyname

urlmon

CoInternetGetProtocolFlags
GetClassFileOrMime
CopyStgMedium
URLOpenStreamA
CoInternetParseUrl
CoInternetCompareUrl
CompareSecurityIds
URLDownloadToFileA
WriteHitLogging
HlinkSimpleNavigateToMoniker
GetComponentIDFromCLSSPEC
FindMediaTypeClass
CoInternetGetSession
SetSoftwareUpdateAdvertisementState
RegisterBindStatusCallback

odbctrac

TraceSQLError
TraceSQLGetData

wsock32

WSAAsyncGetHostByAddr
GetTypeByNameA
WEP
rcmd
inet_network
WSASetBlockingHook

Sections

.Ddbsq
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.N
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.eVupHG
Size: 91KB - Virtual size: 91KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.Mc
Size: 3KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tSlRk
Size: 5KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.oIO
Size: 9KB - Virtual size: 259KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.EBPEyh
Size: 512B - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bDw
Size: 91KB - Virtual size: 91KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.yOSLB
Size: 4KB - Virtual size: 116KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0e593ac12d661f8ad7f0180465be632d

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

04:94:d7:39:bc:82:c7:14:9e:be:00:e2:c8:d7:be:f6Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

f7:74:eb:78:e2:f4:5b:06:34:11:c7:47:48:a3:d1:d9:71:5f:f2:dfSigner

Headers

File Characteristics

Imports

kernel32

user32

shell32

ole32

oleaut32

opengl32

ws2_32

urlmon

odbctrac

wsock32

Sections

.Ddbsq Size: 4KB - Virtual size: 4KB

.N Size: 12KB - Virtual size: 12KB

.eVupHG Size: 91KB - Virtual size: 91KB

.Mc Size: 3KB - Virtual size: 89KB

.tSlRk Size: 5KB - Virtual size: 19KB

.oIO Size: 9KB - Virtual size: 259KB

.EBPEyh Size: 512B - Virtual size: 50KB

.bDw Size: 91KB - Virtual size: 91KB

.yOSLB Size: 4KB - Virtual size: 116KB

.rsrc Size: 7KB - Virtual size: 7KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

04:94:d7:39:bc:82:c7:14:9e:be:00:e2:c8:d7:be:f6
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

f7:74:eb:78:e2:f4:5b:06:34:11:c7:47:48:a3:d1:d9:71:5f:f2:df
Signer

.Ddbsq
Size: 4KB - Virtual size: 4KB

.N
Size: 12KB - Virtual size: 12KB

.eVupHG
Size: 91KB - Virtual size: 91KB

.Mc
Size: 3KB - Virtual size: 89KB

.tSlRk
Size: 5KB - Virtual size: 19KB

.oIO
Size: 9KB - Virtual size: 259KB

.EBPEyh
Size: 512B - Virtual size: 50KB

.bDw
Size: 91KB - Virtual size: 91KB

.yOSLB
Size: 4KB - Virtual size: 116KB

.rsrc
Size: 7KB - Virtual size: 7KB