664cf19c80e3378b5a9c5decb89e3c73_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

664cf19c80e3378b5a9c5decb89e3c73_JaffaCakes118
Size

1.6MB
MD5

664cf19c80e3378b5a9c5decb89e3c73
SHA1

e884eee3347467012534c45d9febfc71ba8f9d99
SHA256

3783454e3abdcbc8d72a132f12be10318def833bda0bf3150e6c5be2a57ee5e6
SHA512

4d898e18f5f7adb231d49e39145a4347abba9113ace4cb8e9899434c48c42bbd8361e1bce311fa893d6182bdbc95b01a2e4e0ffaf88819215078aa0f6afd125b
SSDEEP

49152:BKnAg6ZRStNZsvQ3gP69WCpcBNxuewkckknR/0:8j6ZRSPmvQwP69vch0Z0

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

664cf19c80e3378b5a9c5decb89e3c73_JaffaCakes118
.exe windows:4 windows x64 arch:x64

Code Sign

75:3e:5c:ef:ec:b6:3d:75:b2:cc:6b:83:03:2f:89:9e
Certificate

Issuer

CN=WZTeam

Not Before

02/11/2016, 18:47

Not After

31/12/2039, 23:59

Subject

CN=WZTeam

Extended Key Usages

ExtKeyUsageCodeSigning

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

1a:05:da:b8:f0:7a:e8:40:be:ad:78:fe:b2:55:a8:74
Certificate

Issuer

CN=WZTeam

Not Before

10/03/2017, 18:02

Not After

31/12/2039, 23:59

Subject

CN=WZTeam

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

b5:45:10:5e:ea:96:7a:f2:45:f6:b5:82:80:2e:f1:58:4f:80:95:33:56:60:74:c3:7d:e3:3e:a0:a0:7a:88:7b
Signer

Actual PE Digest

b5:45:10:5e:ea:96:7a:f2:45:f6:b5:82:80:2e:f1:58:4f:80:95:33:56:60:74:c3:7d:e3:3e:a0:a0:7a:88:7b

Digest Algorithm

sha256

PE Digest Matches

true

c1:4e:c6:11:1e:9b:be:0e:bb:03:d0:9e:6e:5c:0d:e9:be:a0:55:ba
Signer

Actual PE Digest

c1:4e:c6:11:1e:9b:be:0e:bb:03:d0:9e:6e:5c:0d:e9:be:a0:55:ba

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

UPX0
Size: - Virtual size: 4.4MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 46KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

Code Sign

75:3e:5c:ef:ec:b6:3d:75:b2:cc:6b:83:03:2f:89:9eCertificate

Extended Key Usages

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0bCertificate

Extended Key Usages

Key Usages

1a:05:da:b8:f0:7a:e8:40:be:ad:78:fe:b2:55:a8:74Certificate

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77Certificate

Extended Key Usages

Key Usages

b5:45:10:5e:ea:96:7a:f2:45:f6:b5:82:80:2e:f1:58:4f:80:95:33:56:60:74:c3:7d:e3:3e:a0:a0:7a:88:7bSigner

c1:4e:c6:11:1e:9b:be:0e:bb:03:d0:9e:6e:5c:0d:e9:be:a0:55:baSigner

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 4.4MB

UPX1 Size: 1.6MB - Virtual size: 1.6MB

.rsrc Size: 46KB - Virtual size: 48KB

75:3e:5c:ef:ec:b6:3d:75:b2:cc:6b:83:03:2f:89:9e
Certificate

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

1a:05:da:b8:f0:7a:e8:40:be:ad:78:fe:b2:55:a8:74
Certificate

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

b5:45:10:5e:ea:96:7a:f2:45:f6:b5:82:80:2e:f1:58:4f:80:95:33:56:60:74:c3:7d:e3:3e:a0:a0:7a:88:7b
Signer

c1:4e:c6:11:1e:9b:be:0e:bb:03:d0:9e:6e:5c:0d:e9:be:a0:55:ba
Signer

UPX0
Size: - Virtual size: 4.4MB

UPX1
Size: 1.6MB - Virtual size: 1.6MB

.rsrc
Size: 46KB - Virtual size: 48KB