jaffacakes118_ef280b6e9392acd9570981ba7baf1078760ec276398ee95f17ddad87afa0cc85[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_ef280b6e9392acd9570981ba7baf1078760ec276398ee95f17ddad87afa0cc85.bin
Size 618KB
Sample261002-kycqesee39
SHA256 ef280b6e9392acd9570981ba7baf1078760ec276398ee95f17ddad87afa0cc85
MD5 92360197d6a0dab2027dd2507df5c6bb
SHA1 ffcdfd11c99f02c71e3365d70f1272aa58dccf33
SHA512 de5b88da6f30e17107e646bb292b8e61f98c70529db1648a75456d4dad632b0b197371f56cc5e807c1ec87904832b9c72f64c33ceb55a081a6a8ded7124e0ec8
SSDEEP 12288:or+11WIfAFuFLHBPnzJtMjqnCHBoYXNrSi6fI7XHgZQKhJgeCmAQzRzSJ:or+SIL5zJtMjqnYrSirLHgZpJEs4J
TLSH
T184D4F023F3D3653BD263523291393232BBBE1A301A024B5767945E927B971E27E1C367
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
jaffacakes118_ef280b6e9392acd9570981ba7baf1078760ec276398ee95f17ddad87afa0cc85.bin

File Explorer

jaffacakes118_ef280b6e9392acd9570981ba7baf1078760ec276398ee95f17ddad87afa0cc85.bin

.exe 618KB

jaffacakes118_ef280b6e9392acd9570981ba7baf1078760ec276398ee95f17ddad87afa0cc85.bin

IMPHASH 4ee3b2a3976285572a1d9ba60a85aede
SHA256 ef280b6e9392acd9570981ba7baf1078760ec276398ee95f17ddad87afa0cc85
MD5 92360197d6a0dab2027dd2507df5c6bb
SHA1 ffcdfd11c99f02c71e3365d70f1272aa58dccf33
SHA512 de5b88da6f30e17107e646bb292b8e61f98c70529db1648a75456d4dad632b0b197371f56cc5e807c1ec87904832b9c72f64c33ceb55a081a6a8ded7124e0ec8
SSDEEP 12288:or+11WIfAFuFLHBPnzJtMjqnCHBoYXNrSi6fI7XHgZQKhJgeCmAQzRzSJ:or+SIL5zJtMjqnYrSirLHgZpJEs4J
TLSH
T184D4F023F3D3653BD263523291393232BBBE1A301A024B5767945E927B971E27E1C367
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

a4:09:98:9d:76:49:4a:f8:39:4e:2f:d8:b6:c8:38:0f:ee:50:54:6d

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 8, 2007

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

Serial Number

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40

Issuer

Timespan

Jan 10, 1997 - Dec 31, 2020

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

2e:ab:11:dc:50:ff:5c:9d:cb:c0

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 22, 2007 - Aug 25, 2012

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0f:78:4d:00:00:00:00:00:03

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 23, 2007 - Feb 23, 2009

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:27F4-D440-54F3,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:14:2c:a7:00:00:00:00:00:06

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 12, 2007 - Jun 13, 2012

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 16, 2006 - Sep 15, 2019

Minor OS version

Major OS version

Entry point

402004

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

dw20.pdb

advapi32

RegCloseKey RegOpenKeyExA RegSetValueExA RegCreateKeyExA DeregisterEventSource ReportEventA RegisterEventSourceW ReportEventW RegQueryValueExA RegEnumKeyExA RegQueryInfoKeyA RegEnumValueA GetUserNameA RegQueryValueExW RegSetValueExW RegDeleteValueW ConvertStringSecurityDescriptorToSecurityDescriptorA ConvertSidToStringSidA SetNamedSecurityInfoW GetSecurityDescriptorDacl RegDeleteValueA FreeSid CheckTokenMembership AllocateAndInitializeSid RegEnumValueW RegQueryInfoKeyW GetLengthSid AddAccessAllowedAce AddAccessDeniedAce InitializeAcl IsValidSid CopySid GetTokenInformation OpenProcessToken OpenThreadToken SetSecurityDescriptorDacl InitializeSecurityDescriptor ConvertStringSecurityDescriptorToSecurityDescriptorW AddAce

comctl32

ImageList_Destroy ImageList_Create ImageList_ReplaceIcon ord17

gdi32

GetTextMetricsA DeleteDC RestoreDC DeleteObject GetTextFaceA SelectObject CreateFontA GetDeviceCaps SetMapMode SaveDC CreateFontIndirectW GetObjectW GetTextExtentPoint32W SetTextAlign CreateFontIndirectA GetObjectA ExtTextOutW SetTextColor SetBkMode

kernel32

GetUserDefaultLangID GetACP GetSystemDefaultLCID FreeLibrary MultiByteToWideChar GetProcAddress GetVersionExW GetVersionExA GetModuleFileNameW InitializeCriticalSection GetProcessHeap DeleteCriticalSection GetModuleHandleA lstrcpynA SetEvent CreateProcessW ExpandEnvironmentStringsW CreateFileMappingA GetFileSize CreateFileA UnmapViewOfFile CreateFileW GetTickCount WideCharToMultiByte WriteFile SetFilePointer GetTempPathW GetFileAttributesW SetEndOfFile IsDBCSLeadByte GetSystemDirectoryA SetThreadPriority CreateRemoteThread OpenProcess GetSystemDefaultUILanguage SetEnvironmentVariableA CreateDirectoryW GetLocalTime ReadProcessMemory VirtualQueryEx GetSystemInfo FindClose FindNextFileW FindFirstFileW GetComputerNameA SetPriorityClass SuspendThread ExitThread GetSystemTimeAsFileTime GetTimeFormatW GetDateFormatW LocalFree GetSystemWindowsDirectoryW MoveFileW lstrcmpiW GetLongPathNameW GetShortPathNameW GetSystemDefaultLangID GlobalAlloc QueryPerformanceCounter VirtualProtect UnhandledExceptionFilter GetCurrentThread LocalAlloc GetLocaleInfoA GetVersion GetShortPathNameA OpenEventA CreateEventA OpenSemaphoreA CreateSemaphoreA OpenMutexA CreateMutexA GetProcessTimes GetModuleHandleW TlsGetValue TlsSetValue TlsFree TlsAlloc InitializeCriticalSectionAndSpinCount SetFileAttributesW InterlockedExchange InterlockedIncrement InterlockedDecrement GetUserDefaultLCID CompareStringW IsValidCodePage GetStringTypeExW IsValidLocale VirtualAlloc VirtualFree DuplicateHandle GetThreadSelectorEntry TerminateThread HeapCreate HeapFree HeapReAlloc HeapAlloc HeapDestroy LoadLibraryW GetPriorityClass GetThreadPriority GetThreadTimes GetThreadContext GetStartupInfoA ResumeThread GetCurrentThreadId OutputDebugStringA DebugBreak LoadLibraryA GetModuleFileNameA MulDiv SetLastError SetUnhandledExceptionFilter GetCurrentProcessId GetLastError CloseHandle CreateThread DeleteFileW TerminateProcess Sleep GetCurrentProcess SetProcessWorkingSetSize EnterCriticalSection LeaveCriticalSection WaitForMultipleObjects WaitForSingleObject ReleaseMutex MapViewOfFile GetCommandLineW GlobalFree LoadLibraryExA

oleacc

LresultFromObject CreateStdAccessibleObject

ole32

CoCreateInstance CoInitializeEx CoUninitialize StringFromIID CoTaskMemFree

oleaut32

VariantTimeToDosDateTime SysAllocString SysFreeString SystemTimeToVariantTime SysStringLen

msvcrt

_amsg_exit __getmainargs _initterm __setusermatherr _adjust_fdiv __p__commode __p__fmode __set_app_type __dllonexit _onexit _controlfp _acmdln exit _cexit _ismbblead _XcptFilter _exit _c_exit time memset memcpy memmove tolower ceil strchr wcschr _except_handler3

rpcrt4

UuidCreate

shell32

ShellExecuteExA SHGetSpecialFolderPathW ExtractIconExA

shlwapi

wnsprintfA AssocQueryStringW UrlGetPartA wvnsprintfA wnsprintfW

urlmon

CreateURLMoniker

user32

IsWindow CreateDialogIndirectParamA MapDialogRect CallWindowProcA CallWindowProcW LoadBitmapA GetParent SendMessageTimeoutA EnumWindows GetWindowThreadProcessId IsIconic GetWindowPlacement DestroyIcon GetForegroundWindow FlashWindowEx GetFocus SetScrollInfo SystemParametersInfoA GetScrollInfo SetDlgItemTextA IsDlgButtonChecked LoadStringA SetFocus CheckDlgButton DestroyWindow GetDlgCtrlID SendDlgItemMessageA GetSysColor EnableWindow CreateDialogParamW SetWindowTextA GetDC MapWindowPoints GetSysColorBrush FillRect ReleaseDC SetWindowLongA LoadIconA GetSystemMetrics SetForegroundWindow GetWindowLongA GetWindowRect SetWindowPos DialogBoxParamA RegisterClassExA CreateWindowExA GetMessageA IsDialogMessageA TranslateMessage DispatchMessageA PostQuitMessage KillTimer SetTimer DefWindowProcA SendMessageA PostMessageA GetWindow IsWindowVisible MoveWindow SetRectEmpty DrawTextW GetWindowLongW DrawTextA IsWindowUnicode SendMessageW GetClassNameA EndDialog UpdateWindow SetWindowTextW DrawFocusRect GetClientRect SetCursor InvalidateRect LoadCursorA ShowWindow LoadStringW DrawIconEx GetDlgItem EnumDisplayMonitors DialogBoxParamW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueA

wininet

InternetCloseHandle HttpQueryInfoA InternetReadFileExA InternetWriteFile HttpSendRequestExA HttpOpenRequestA InternetConnectA InternetOpenA InternetSetStatusCallback InternetGetConnectedState InternetCanonicalizeUrlA InternetCrackUrlA HttpEndRequestA

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_ef280b6e9392acd9570981ba7baf1078760ec276398ee95f17ddad87afa0cc85.bin

PE Signature issue

advapi32

comctl32

gdi32

kernel32

oleacc

ole32

oleaut32

msvcrt

rpcrt4

shell32

shlwapi

urlmon

user32

version

wininet

generic