f830668abfd1521650aff0cbfbe0ab4e_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

f830668abfd1521650aff0cbfbe0ab4e_JaffaCakes118
Size

665KB
MD5

f830668abfd1521650aff0cbfbe0ab4e
SHA1

e1250aefff57aebe6739e5990c52df86bbbcd841
SHA256

34da4b3d4fd6fc4aa6627d1b2723bb29e6187d2438d07efe8260d3eb34be47d4
SHA512

fa4141832234548cdbcec91f52fed2fed61f7084a76a228ebaca40555b42569890058a327d2e681eaa293be60b016953487a0cc788b21f23ca4317de87533df0
SSDEEP

12288:vt/OzBP0yd8fo/BC5gMdPzNRNN+nHPPgJHHgxKtarc8UbaFmnB2:vteBP0045Zdrb2HgJg5c7bk

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

f830668abfd1521650aff0cbfbe0ab4e_JaffaCakes118
.exe windows:5 windows x86 arch:x86

Code Sign

39:14:84
Certificate

Issuer

OU=Starfield Class 2 Certification Authority,O=Starfield Technologies\, Inc.,C=US

Not Before

01/01/2014, 07:00

Not After

30/05/2031, 07:00

Subject

CN=Starfield Root Certificate Authority - G2,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

07
Certificate

Issuer

CN=Starfield Root Certificate Authority - G2,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

03/05/2011, 07:00

Not After

03/05/2031, 07:00

Subject

CN=Starfield Secure Certificate Authority - G2,OU=http://certs.starfieldtech.com/repository/,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

01:0c
Certificate

Issuer

CN=http://www.valicert.com/,OU=ValiCert Class 2 Policy Validation Authority,O=ValiCert\, Inc.,L=ValiCert Validation Network,1.2.840.113549.1.9.1=#0c11696e666f4076616c69636572742e636f6d

Not Before

29/06/2004, 17:39

Not After

29/06/2024, 17:39

Subject

OU=Starfield Class 2 Certification Authority,O=Starfield Technologies\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

07:9e:a5:8c:1a:6e:d1
Certificate

Issuer

CN=Starfield Secure Certificate Authority - G2,OU=http://certs.starfieldtech.com/repository/,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

22/07/2014, 14:14

Not After

22/07/2015, 14:14

Subject

CN=PLUGIN UPDATE S.L,O=PLUGIN UPDATE S.L,L=GUIA DE ISORA,C=ES

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

45:e3:02:3e:53:23:1d:a9:ab:fb:52:1d:9c:5e:ed:28:bf:aa:0d:91
Signer

Actual PE Digest

45:e3:02:3e:53:23:1d:a9:ab:fb:52:1d:9c:5e:ed:28:bf:aa:0d:91

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 1.3MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 621KB - Virtual size: 624KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

Code Sign

39:14:84Certificate

Key Usages

07Certificate

Key Usages

01:0cCertificate

Key Usages

07:9e:a5:8c:1a:6e:d1Certificate

Extended Key Usages

Key Usages

45:e3:02:3e:53:23:1d:a9:ab:fb:52:1d:9c:5e:ed:28:bf:aa:0d:91Signer

Headers

DLL Characteristics

File Characteristics

Sections

UPX0 Size: - Virtual size: 1.3MB

UPX1 Size: 621KB - Virtual size: 624KB

.rsrc Size: 36KB - Virtual size: 36KB

39:14:84
Certificate

07
Certificate

01:0c
Certificate

07:9e:a5:8c:1a:6e:d1
Certificate

45:e3:02:3e:53:23:1d:a9:ab:fb:52:1d:9c:5e:ed:28:bf:aa:0d:91
Signer

UPX0
Size: - Virtual size: 1.3MB

UPX1
Size: 621KB - Virtual size: 624KB

.rsrc
Size: 36KB - Virtual size: 36KB