fada2e3be6a83ce26efbab3e9b11a50b_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

fada2e3be6a83ce26efbab3e9b11a50b_JaffaCakes118
Size

202KB
MD5

fada2e3be6a83ce26efbab3e9b11a50b
SHA1

f8371a33bde2fbeb7c6c0b2324a63980535cb074
SHA256

f01ff229e3290a19dd49c780abe76a35b7c1a3a1df48c0aebc416360c7384d78
SHA512

023ad19b49b91aff80e57b8153b3ed811b2e6731e161ece05a59c6fef37a003c1d53352b3eaab774c514d0653f8b2af2dc5c5da0af19f43dd233f9065a25297c
SSDEEP

6144:N2f7xz5jBEciLzLsOu+/ifpY5MY5FjV0FYtOsN/Vm7mxN3B+Xq:Nul9lE/LsANz5jXtOsN/I74Nx+6

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
upx

Processes:

resource yara_rule

sample upx
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

unpack001/out.upx

resource	yara_rule
sample	upx

resource
unpack001/out.upx

Files

fada2e3be6a83ce26efbab3e9b11a50b_JaffaCakes118
.exe windows:5 windows x86 arch:x86

Code Sign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16-07-2004 00:00

Not After

15-07-2014 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4f:ea:b5:57:30:a7:55:a4:56:fe:6c:18:a4:79:1c:1a
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

19-05-2009 00:00

Not After

19-05-2011 23:59

Subject

CN=Pinball Corporation.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Pinball Corporation.,L=Bellevue,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1c:7d:94:f2:47:26:b4:a8:26:94:9c:45:6b:2f:d3:47:fb:b3:4c:a1
Signer

Actual PE Digest

1c:7d:94:f2:47:26:b4:a8:26:94:9c:45:6b:2f:d3:47:fb:b3:4c:a1

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 268KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 191KB - Virtual size: 192KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 278KB - Virtual size: 278KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 65KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 75KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

4f:ea:b5:57:30:a7:55:a4:56:fe:6c:18:a4:79:1c:1aCertificate

Extended Key Usages

Key Usages

1c:7d:94:f2:47:26:b4:a8:26:94:9c:45:6b:2f:d3:47:fb:b3:4c:a1Signer

Headers

DLL Characteristics

File Characteristics

Sections

UPX0 Size: - Virtual size: 268KB

UPX1 Size: 191KB - Virtual size: 192KB

.rsrc Size: 7KB - Virtual size: 8KB

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 278KB - Virtual size: 278KB

.rdata Size: 65KB - Virtual size: 65KB

.data Size: 10KB - Virtual size: 20KB

.rsrc Size: 75KB - Virtual size: 75KB

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

4f:ea:b5:57:30:a7:55:a4:56:fe:6c:18:a4:79:1c:1a
Certificate

1c:7d:94:f2:47:26:b4:a8:26:94:9c:45:6b:2f:d3:47:fb:b3:4c:a1
Signer

UPX0
Size: - Virtual size: 268KB

UPX1
Size: 191KB - Virtual size: 192KB

.rsrc
Size: 7KB - Virtual size: 8KB

.text
Size: 278KB - Virtual size: 278KB

.rdata
Size: 65KB - Virtual size: 65KB

.data
Size: 10KB - Virtual size: 20KB

.rsrc
Size: 75KB - Virtual size: 75KB