JaffaCakes118_4e63f1b475247ed16489b4f1058822c6

Sharing

Copy URL

Twitter E-mail

General

Target

JaffaCakes118_4e63f1b475247ed16489b4f1058822c6
Size

343KB
MD5

4e63f1b475247ed16489b4f1058822c6
SHA1

6680f99c850092cc34d94a9bf7b91c047602ffd1
SHA256

57dc3d3312860388e72aeb652ecef12915e90ec3a110db77b1e0b28c4e8ad664
SHA512

9c2f230177135ac233782065171c6948c09930d49899dc3d82d48f7aa9ad094aaa0ea4742f373cb3f68b23211c5cebe6dbb6a7d47b5271aa71d56878877d287b
SSDEEP

3072:XQhZkOLfuDg0PtOqzKONqsEykRLSDUKUO8EtjWELmTb2hctJ/G8wtTn:rOFStZzKqqsE6CstjLyTb2hca8mn

Score

1^/10

Malware Config

Signatures

Files

JaffaCakes118_4e63f1b475247ed16489b4f1058822c6
.exe windows:4 windows x86 arch:x86

ff7d746075fccb89430acf2f6843b047

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

75:cb:09:ca:78:6f:6e:86:dd:a3:50:3b:31:2d:58:e2
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

21-10-2010 00:00

Not After

20-11-2011 23:59

Subject

CN=Neowiz CORPORATION,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Neowiz CORPORATION,L=Gangnam,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

49:95:0c:f0:cb:4b:2a:0f:a5:a6:53:25:07:01:c9:21:10:d0:c4:84
Signer

Actual PE Digest

49:95:0c:f0:cb:4b:2a:0f:a5:a6:53:25:07:01:c9:21:10:d0:c4:84

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapAlloc
GetProcessHeap
VirtualAlloc
Sleep
VirtualProtect
VirtualFree
GetProcAddress
LoadLibraryA
IsBadReadPtr
FreeLibrary
IsBadWritePtr
HeapValidate
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
DebugBreak
GetStdHandle
WriteFile
InterlockedDecrement
OutputDebugStringA
InterlockedIncrement
GetModuleFileNameA
HeapReAlloc
HeapFree
GetLastError
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetFileType
RtlUnwind
SetConsoleCtrlHandler
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
GetCPInfo
GetACP
GetOEMCP
SetFilePointer
LCMapStringA
LCMapStringW
SetStdHandle
FlushFileBuffers
CloseHandle
LocalAlloc
InterlockedExchange
RaiseException
LocalFree

Exports

Exports

Hai

Sections

.text
Size: 327KB - Virtual size: 326KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didat
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ff7d746075fccb89430acf2f6843b047

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

75:cb:09:ca:78:6f:6e:86:dd:a3:50:3b:31:2d:58:e2Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

49:95:0c:f0:cb:4b:2a:0f:a5:a6:53:25:07:01:c9:21:10:d0:c4:84Signer

Headers

File Characteristics

Imports

kernel32

Exports

Exports

Sections

.text Size: 327KB - Virtual size: 326KB

.idata Size: 2KB - Virtual size: 2KB

.didat Size: 2KB - Virtual size: 1KB

.rsrc Size: 512B - Virtual size: 4KB

.reloc Size: 4KB - Virtual size: 4KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

75:cb:09:ca:78:6f:6e:86:dd:a3:50:3b:31:2d:58:e2
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

49:95:0c:f0:cb:4b:2a:0f:a5:a6:53:25:07:01:c9:21:10:d0:c4:84
Signer

.text
Size: 327KB - Virtual size: 326KB

.idata
Size: 2KB - Virtual size: 2KB

.didat
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 512B - Virtual size: 4KB

.reloc
Size: 4KB - Virtual size: 4KB