jaffacakes118_e43070fac06cec192671d639cf4bd95239726d6ef5e4393ca29463afc5f5e482[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_e43070fac06cec192671d639cf4bd95239726d6ef5e4393ca29463afc5f5e482.bin
Size 141KB
Sample261002-jh18eacf48
SHA256 e43070fac06cec192671d639cf4bd95239726d6ef5e4393ca29463afc5f5e482
MD5 32fe6b6663f3e949c3abee14900d5668
SHA1 12c93b08ce680094df14f473a813c418ba1e0091
SHA512 ec9a17f5567adda44a2cd376fc4b0cc0315e98a4b1bb26de57999b108763f24e04c7a4054000e5489a5e945c0f7c0f5a2eea49d3f405e0ba63a0a1f7534aa938
SSDEEP 3072:sYHcoXH2FnGPebi/ACIJOFDSnFtlgPyyJc30tHTY8R:TAJJOwn+PEev
TLSH
T1FEE38C0276A6C873D88E023E596A87895B7FBD019FA625C3F7D8378D9D702C19F39241
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
jaffacakes118_e43070fac06cec192671d639cf4bd95239726d6ef5e4393ca29463afc5f5e482.bin

File Explorer

jaffacakes118_e43070fac06cec192671d639cf4bd95239726d6ef5e4393ca29463afc5f5e482.bin

.dll 141KB

jaffacakes118_e43070fac06cec192671d639cf4bd95239726d6ef5e4393ca29463afc5f5e482.bin

IMPHASH 7f449cc63ee2323a20191a26b09d06bc
SHA256 e43070fac06cec192671d639cf4bd95239726d6ef5e4393ca29463afc5f5e482
MD5 32fe6b6663f3e949c3abee14900d5668
SHA1 12c93b08ce680094df14f473a813c418ba1e0091
SHA512 ec9a17f5567adda44a2cd376fc4b0cc0315e98a4b1bb26de57999b108763f24e04c7a4054000e5489a5e945c0f7c0f5a2eea49d3f405e0ba63a0a1f7534aa938
SSDEEP 3072:sYHcoXH2FnGPebi/ACIJOFDSnFtlgPyyJc30tHTY8R:TAJJOwn+PEev
TLSH
T1FEE38C0276A6C873D88E023E596A87895B7FBD019FA625C3F7D8378D9D702C19F39241
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

53:a1:ac:64:6b:d6:8c:c0:0a:3c:50:9c:93:7d:d9:31:2a:ef:4a:4d

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=MAPILab Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=MAPILab Ltd,L=Kaliningrad,ST=Russia,C=RU

Chains

Sep 30, 2011

CN=MAPILab Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=MAPILab Ltd,L=Kaliningrad,ST=Russia,C=RU

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=MAPILab Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=MAPILab Ltd,L=Kaliningrad,ST=Russia,C=RU

Serial Number

4c:eb:0d:ef:a8:dd:2c:1c:85:66:23:c8:2e:cc:19:a1

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 28, 2011 - Sep 27, 2014

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

52693

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\MyProjects\outlsec\secman\Release\secman.pdb

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

kernel32

GetModuleFileNameA GetLastError WideCharToMultiByte lstrlenW WriteFile GetLocalTime CreateFileA CloseHandle WriteProcessMemory GetCurrentProcess MultiByteToWideChar OpenProcess CreateProcessA RaiseException InitializeCriticalSection DeleteCriticalSection lstrlenA lstrcmpiA FreeLibrary LoadLibraryExA LoadLibraryA WaitForMultipleObjects CreateEventA SetEvent OpenEventA ExitThread FreeLibraryAndExitThread WaitForSingleObject Sleep CreateThread GetCurrentThreadId SetLastError ResetEvent InterlockedDecrement IsDBCSLeadByte EnterCriticalSection LeaveCriticalSection SizeofResource LoadResource FindResourceA GetCurrentProcessId SetThreadLocale GetThreadLocale InterlockedExchange GetACP GetLocaleInfoA GetVersionExA LCMapStringW LCMapStringA GetStringTypeW GetStringTypeA IsValidCodePage GetOEMCP GetCPInfo GetSystemTimeAsFileTime GetTickCount QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA GetFileAttributesA GetModuleHandleA GetProcAddress InterlockedIncrement GetFileType SetHandleCount GetStdHandle ExitProcess TlsFree TlsSetValue TlsAlloc TlsGetValue HeapSize VirtualFree HeapCreate HeapDestroy IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess GetProcessHeap GetCommandLineA VirtualQuery GetSystemInfo VirtualAlloc VirtualProtect RtlUnwind HeapReAlloc HeapAlloc HeapFree

user32

PostThreadMessageA DefWindowProcA CreateWindowExA GetClassInfoA wsprintfA wvsprintfA CharNextA PostMessageA FindWindowA MessageBoxA GetWindowThreadProcessId SetWindowsHookExA ShowWindow UnhookWindowsHookEx SendMessageA GetMessageA DispatchMessageA TranslateMessage GetSysColorBrush UnregisterClassA RegisterClassA

advapi32

RegEnumKeyExA RegQueryInfoKeyA RegSetValueExA RegCreateKeyExA RegDeleteValueA RegDeleteKeyA RegOpenKeyExA RegQueryValueExA RegCloseKey

ole32

CoTaskMemFree StringFromCLSID CLSIDFromString CLSIDFromProgID CoTaskMemAlloc StringFromGUID2 CoCreateInstance CoTaskMemRealloc

oleaut32

VARIANT_UserUnmarshal VARIANT_UserMarshal VARIANT_UserSize SysFreeString VariantClear SysAllocStringLen VarUI4FromStr SysStringLen LoadRegTypeLi LoadTypeLi SysAllocString UnRegisterTypeLi RegisterTypeLi VARIANT_UserFree

rpcrt4

NdrStubForwardingFunction IUnknown_Release_Proxy IUnknown_AddRef_Proxy NdrDllUnregisterProxy NdrDllRegisterProxy NdrCStdStubBuffer2_Release NdrDllCanUnloadNow NdrDllGetClassObject NdrOleAllocate NdrOleFree IUnknown_QueryInterface_Proxy NdrStubCall2

Name

.text

Size

76KB

Virtual Size

75KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.orpc

Size

4KB

Virtual Size

576B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

24KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

12KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_e43070fac06cec192671d639cf4bd95239726d6ef5e4393ca29463afc5f5e482.bin

PE Signature issue

version

kernel32

user32

advapi32

ole32

oleaut32

rpcrt4

generic