47f39f0e53704310f2205bfaa7ce09fe_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

47f39f0e53704310f2205bfaa7ce09fe_JaffaCakes118
Size

521KB
MD5

47f39f0e53704310f2205bfaa7ce09fe
SHA1

d72811a288999fbb373643e0b54b83d6c55c0fa9
SHA256

0475704001780b9fa907a1f288bb8656d32d5df89b6f6ba8248d10b78f3c2da8
SHA512

8a618239c122e45ccf121b4c819787a90791a9f8967a0802e54f35fcc6f74bf6e13e33d5a1972f4990d5a4c41f3b1dfe1e42c3dac4a37d9e51aff574ee6444ee
SSDEEP

12288:gEs0JrQw7u6C5uz4Wxzbt4FPmzI2RWv+8ehOx5n4:Js0JrQN5i4ezbmFPmcDn4

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

47f39f0e53704310f2205bfaa7ce09fe_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

19:9d:f8:8e
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Class 3 Code Signing CA,O=WoSign eCommerce Services Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

02:b0:cd:1e:c2:90:a6
Certificate

Issuer

CN=WoSign Class 3 Code Signing CA,O=WoSign eCommerce Services Limited,C=CN

Not Before

14/11/2011, 20:38

Not After

17/11/2014, 16:20

Subject

CN=广州华多网络科技有限公司,O=广州华多网络科技有限公司,L=广州市,ST=广东省,C=CN,1.2.840.113549.1.9.1=#0c1568757469616e7975406368696e6164756f2e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

3d
Certificate

Issuer

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Not Before

01/03/2011, 01:00

Not After

01/03/2016, 01:00

Subject

CN=Certification Authority of WoSign,O=WoSign eCommerce Services Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

70:05:8a:73:86:a1:fc:82:7b:13:4c:45:d5:66:9d:41:48:e2:b2:7e
Signer

Actual PE Digest

70:05:8a:73:86:a1:fc:82:7b:13:4c:45:d5:66:9d:41:48:e2:b2:7e

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 672KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 311KB - Virtual size: 312KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 29KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.spm
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:beCertificate

Extended Key Usages

Key Usages

19:9d:f8:8eCertificate

Key Usages

02:b0:cd:1e:c2:90:a6Certificate

Extended Key Usages

Key Usages

3dCertificate

Key Usages

70:05:8a:73:86:a1:fc:82:7b:13:4c:45:d5:66:9d:41:48:e2:b2:7eSigner

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 672KB

UPX1 Size: 311KB - Virtual size: 312KB

.rsrc Size: 29KB - Virtual size: 32KB

.spm Size: 1KB - Virtual size: 4KB

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

19:9d:f8:8e
Certificate

02:b0:cd:1e:c2:90:a6
Certificate

3d
Certificate

70:05:8a:73:86:a1:fc:82:7b:13:4c:45:d5:66:9d:41:48:e2:b2:7e
Signer

UPX0
Size: - Virtual size: 672KB

UPX1
Size: 311KB - Virtual size: 312KB

.rsrc
Size: 29KB - Virtual size: 32KB

.spm
Size: 1KB - Virtual size: 4KB