3dc5979a20c0c7baad037b961df488db_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

3dc5979a20c0c7baad037b961df488db_JaffaCakes118
Size

4.6MB
MD5

3dc5979a20c0c7baad037b961df488db
SHA1

891af89cf297e86cd1e1496b57786f6e2893be87
SHA256

318d1d2d79628b1940c330b15e025bb2fd37c19fae762b4c9efd4080235248c8
SHA512

240e3089b55c3223e63ee084fdf632e0a00a91f39720fd430cbd797dde207e91dc412969e36b9611c5f03874f62e00797870fd1771c6ebb1cf1edac4d5e7d0c0
SSDEEP

98304:AYvbkaLVwNpBDEEmdRdmI/uZA/WRWXBRruNnF/qG9o:AY9u8RcIWZXWXXQRq8o

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

3dc5979a20c0c7baad037b961df488db_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Code Sign

21:78:33:60:8b:ee:ed:87:60:ab:fe:13:26:5d:d5:38
Certificate

Issuer

CN=WoSign Class 2 Code Signing CA,O=WoSign CA Limited,C=CN

Not Before

22/10/2015, 02:36

Not After

22/11/2017, 02:36

Subject

CN=张献文,L=亳州市,ST=安徽省,C=CN,1.2.840.113549.1.9.1=#0c0d3437323838314071712e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5e:68:d6:11:71:94:63:50:56:00:68:f3:3e:c9:c5:91
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2039, 01:00

Subject

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:e7:3b:77:32:8e:5c:a0:aa:57:f8:65:68:dc:f6:e8
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Class 2 Code Signing CA,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

71:da:3c:91:7d:67:20:5e:b1:89:89:e6:4a:c9:bc:bd:4b:67:4c:6a
Signer

Actual PE Digest

71:da:3c:91:7d:67:20:5e:b1:89:89:e6:4a:c9:bc:bd:4b:67:4c:6a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 7.7MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 4.6MB - Virtual size: 4.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 34KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

Code Sign

21:78:33:60:8b:ee:ed:87:60:ab:fe:13:26:5d:d5:38Certificate

Extended Key Usages

Key Usages

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4cCertificate

Extended Key Usages

Key Usages

5e:68:d6:11:71:94:63:50:56:00:68:f3:3e:c9:c5:91Certificate

Key Usages

25:e7:3b:77:32:8e:5c:a0:aa:57:f8:65:68:dc:f6:e8Certificate

Extended Key Usages

Key Usages

71:da:3c:91:7d:67:20:5e:b1:89:89:e6:4a:c9:bc:bd:4b:67:4c:6aSigner

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 7.7MB

UPX1 Size: 4.6MB - Virtual size: 4.6MB

.rsrc Size: 34KB - Virtual size: 36KB

21:78:33:60:8b:ee:ed:87:60:ab:fe:13:26:5d:d5:38
Certificate

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

5e:68:d6:11:71:94:63:50:56:00:68:f3:3e:c9:c5:91
Certificate

25:e7:3b:77:32:8e:5c:a0:aa:57:f8:65:68:dc:f6:e8
Certificate

71:da:3c:91:7d:67:20:5e:b1:89:89:e6:4a:c9:bc:bd:4b:67:4c:6a
Signer

UPX0
Size: - Virtual size: 7.7MB

UPX1
Size: 4.6MB - Virtual size: 4.6MB

.rsrc
Size: 34KB - Virtual size: 36KB