45d12da3feb5455e4204bf215e0744b6_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

45d12da3feb5455e4204bf215e0744b6_JaffaCakes118
Size

17.6MB
MD5

45d12da3feb5455e4204bf215e0744b6
SHA1

fbcfb9299b64461aa55b4f3915c88993ca4f3ddd
SHA256

255b2aeace8ef9d74880647355b7eb0336ea33093fa2d4b0569c967b294bac96
SHA512

5db55fd3ae92030fc18d6f899c1b5a1d2b57acb854d4b923aca2ad60c57f2c595cede243835516a49af6510b0954d2f44ad5a5eb034b73915f7c34b2303fac86
SSDEEP

393216:loSKVcOGP0DuOPkFVTfP/w3KzVS7mDWs79fO1:wqFB43Kzsiq0hO1

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/out.upx

Files

45d12da3feb5455e4204bf215e0744b6_JaffaCakes118
.exe windows:5 windows x86 arch:x86

Code Sign

31:5b:47:d3:7a:76:91:6e:33:e3:3a:d5:9f:6c:52:c6
Certificate

Issuer

CN=WoSign Class 3 Code Signing CA,O=WoSign CA Limited,C=CN

Not Before

05-05-2016 05:33

Not After

05-06-2019 05:33

Subject

CN=四川迅游网络科技股份有限公司,O=四川迅游网络科技股份有限公司,L=成都市,ST=四川省,C=CN,1.2.840.113549.1.9.1=#0c0f746563684078756e796f752e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftKernelCodeSigning

Key Usages

KeyUsageDigitalSignature

19:6d:f8:a7
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CN

Not Before

08-08-2012 01:00

Not After

08-08-2027 01:00

Subject

CN=WoSign Class 3 Code Signing CA,O=WoSign eCommerce Services Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08-08-2009 01:00

Not After

08-08-2024 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

1c:b7:a8:d0:5e:37:43:12:5f:42:0d:6a:dd:b5:f2:c7
Certificate

Issuer

CN=WoSign Class 3 Code Signing CA G2,O=WoSign CA Limited,C=CN

Not Before

05-05-2016 05:25

Not After

05-06-2019 05:25

Subject

CN=四川迅游网络科技股份有限公司,O=四川迅游网络科技股份有限公司,L=成都市,ST=四川省,C=CN,1.2.840.113549.1.9.1=#0c0f746563684078756e796f752e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftKernelCodeSigning

Key Usages

KeyUsageDigitalSignature

37:a6:0e:92:5f:23:f8:0c:fd:cd:97:65:92:98:c3:54
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08-11-2014 00:58

Not After

08-11-2029 00:58

Subject

CN=WoSign Class 3 Code Signing CA G2,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08-08-2009 01:00

Not After

08-08-2024 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

59:ff:c5:09:1a:88:80:73:8b:7a:ad:27:1c:9f:2c:27:27:3a:3c:6e:4d:cb:bd:95:ba:20:f3:c0:71:c7:32:3b
Signer

Actual PE Digest

59:ff:c5:09:1a:88:80:73:8b:7a:ad:27:1c:9f:2c:27:27:3a:3c:6e:4d:cb:bd:95:ba:20:f3:c0:71:c7:32:3b

Digest Algorithm

sha256

PE Digest Matches

true

de:37:27:6b:de:f8:75:ac:98:92:90:83:53:e9:57:1b:30:08:f8:ee
Signer

Actual PE Digest

de:37:27:6b:de:f8:75:ac:98:92:90:83:53:e9:57:1b:30:08:f8:ee

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 18.7MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 17.6MB - Virtual size: 17.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 33KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 221KB - Virtual size: 220KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 56KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 35.9MB - Virtual size: 35.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

31:5b:47:d3:7a:76:91:6e:33:e3:3a:d5:9f:6c:52:c6Certificate

Extended Key Usages

Key Usages

19:6d:f8:a7Certificate

Key Usages

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4cCertificate

Extended Key Usages

Key Usages

1c:b7:a8:d0:5e:37:43:12:5f:42:0d:6a:dd:b5:f2:c7Certificate

Extended Key Usages

Key Usages

37:a6:0e:92:5f:23:f8:0c:fd:cd:97:65:92:98:c3:54Certificate

Extended Key Usages

Key Usages

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4cCertificate

Extended Key Usages

Key Usages

59:ff:c5:09:1a:88:80:73:8b:7a:ad:27:1c:9f:2c:27:27:3a:3c:6e:4d:cb:bd:95:ba:20:f3:c0:71:c7:32:3bSigner

de:37:27:6b:de:f8:75:ac:98:92:90:83:53:e9:57:1b:30:08:f8:eeSigner

Headers

DLL Characteristics

File Characteristics

Sections

UPX0 Size: - Virtual size: 18.7MB

UPX1 Size: 17.6MB - Virtual size: 17.6MB

.rsrc Size: 33KB - Virtual size: 36KB

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 221KB - Virtual size: 220KB

.rdata Size: 41KB - Virtual size: 40KB

.data Size: 56KB - Virtual size: 74KB

.rsrc Size: 35.9MB - Virtual size: 35.9MB

31:5b:47:d3:7a:76:91:6e:33:e3:3a:d5:9f:6c:52:c6
Certificate

19:6d:f8:a7
Certificate

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

1c:b7:a8:d0:5e:37:43:12:5f:42:0d:6a:dd:b5:f2:c7
Certificate

37:a6:0e:92:5f:23:f8:0c:fd:cd:97:65:92:98:c3:54
Certificate

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

59:ff:c5:09:1a:88:80:73:8b:7a:ad:27:1c:9f:2c:27:27:3a:3c:6e:4d:cb:bd:95:ba:20:f3:c0:71:c7:32:3b
Signer

de:37:27:6b:de:f8:75:ac:98:92:90:83:53:e9:57:1b:30:08:f8:ee
Signer

UPX0
Size: - Virtual size: 18.7MB

UPX1
Size: 17.6MB - Virtual size: 17.6MB

.rsrc
Size: 33KB - Virtual size: 36KB

.text
Size: 221KB - Virtual size: 220KB

.rdata
Size: 41KB - Virtual size: 40KB

.data
Size: 56KB - Virtual size: 74KB

.rsrc
Size: 35.9MB - Virtual size: 35.9MB