7490e45b5891d065126ba9aac4bb8174_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

7490e45b5891d065126ba9aac4bb8174_JaffaCakes118
Size

3.3MB
MD5

7490e45b5891d065126ba9aac4bb8174
SHA1

7ac32fe59ed67d9560642d9ac3d493cff9d14597
SHA256

59f02c2c87f02a687c1977b6afccfbf662ba6e9e0ab4b4b8522b42278967b490
SHA512

3e50553197fa49b8997630ccb493db862c6943089f84fb5cbc41d582da408110e2ce1c2303597b0e1a03eafa41bd9dab766bf1a16f529b3ad47394221f87c0e5
SSDEEP

98304:wfBDrIm6d2ky9IMw3YStwwTbYXiI33ruVS:wpDCDyKMwN6Cc33ruU

Score

7^/10

upx aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
static1/unpack001/KMSAuto Lite Portable v1.3.5.3/KMSAuto.exe	aspack_v212_v242

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/KMSAuto Lite Portable v1.3.5.3/KMSAuto x64.exe	upx

Files

7490e45b5891d065126ba9aac4bb8174_JaffaCakes118
.zip
KMSAuto Lite Portable v1.3.5.3/KMSAuto x64.exe
.exe windows:4 windows x64 arch:x64

Code Sign

75:3e:5c:ef:ec:b6:3d:75:b2:cc:6b:83:03:2f:89:9e
Certificate

Issuer

CN=WZTeam

Not Before

02-11-2016 18:47

Not After

31-12-2039 23:59

Subject

CN=WZTeam

Extended Key Usages

ExtKeyUsageCodeSigning

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31-12-2015 00:00

Not After

09-07-2019 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

1a:05:da:b8:f0:7a:e8:40:be:ad:78:fe:b2:55:a8:74
Certificate

Issuer

CN=WZTeam

Not Before

10-03-2017 18:02

Not After

31-12-2039 23:59

Subject

CN=WZTeam

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31-12-2015 00:00

Not After

09-07-2019 18:40

Subject

CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

f2:86:08:ca:e2:5b:ee:b8:69:9c:b4:6c:cb:9d:0e:35:2d:77:d3:de:a3:0d:58:d9:4c:56:d8:39:88:5e:38:d9
Signer

Actual PE Digest

f2:86:08:ca:e2:5b:ee:b8:69:9c:b4:6c:cb:9d:0e:35:2d:77:d3:de:a3:0d:58:d9:4c:56:d8:39:88:5e:38:d9

Digest Algorithm

sha256

PE Digest Matches

true

66:50:ed:29:d3:ed:1f:fb:8e:fa:2a:cc:21:9f:be:42:c0:8a:7e:91
Signer

Actual PE Digest

66:50:ed:29:d3:ed:1f:fb:8e:fa:2a:cc:21:9f:be:42:c0:8a:7e:91

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

UPX0
Size: - Virtual size: 4.4MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 46KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
KMSAuto Lite Portable v1.3.5.3/KMSAuto.exe
.exe windows:4 windows x86 arch:x86

Code Sign

75:3e:5c:ef:ec:b6:3d:75:b2:cc:6b:83:03:2f:89:9e
Certificate

Issuer

CN=WZTeam

Not Before

02-11-2016 18:47

Not After

31-12-2039 23:59

Subject

CN=WZTeam

Extended Key Usages

ExtKeyUsageCodeSigning

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31-12-2015 00:00

Not After

09-07-2019 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

1a:05:da:b8:f0:7a:e8:40:be:ad:78:fe:b2:55:a8:74
Certificate

Issuer

CN=WZTeam

Not Before

10-03-2017 18:02

Not After

31-12-2039 23:59

Subject

CN=WZTeam

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31-12-2015 00:00

Not After

09-07-2019 18:40

Subject

CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

36:57:30:6e:5a:d0:51:25:7d:5f:42:5a:da:44:63:69:d2:2b:4a:42:bc:23:63:ad:10:9b:b4:b1:51:a3:c8:f2
Signer

Actual PE Digest

36:57:30:6e:5a:d0:51:25:7d:5f:42:5a:da:44:63:69:d2:2b:4a:42:bc:23:63:ad:10:9b:b4:b1:51:a3:c8:f2

Digest Algorithm

sha256

PE Digest Matches

true

e5:68:ca:50:79:9c:0a:b6:8c:f2:d2:68:20:76:b4:c3:a7:e1:cb:cf
Signer

Actual PE Digest

e5:68:ca:50:79:9c:0a:b6:8c:f2:d2:68:20:76:b4:c3:a7:e1:cb:cf

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.code
Size: 24KB - Virtual size: 120KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 177KB - Virtual size: 376KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 21KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1.4MB - Virtual size: 5.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.msfree
Size: 49KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
KMSAuto Lite Portable v1.3.5.3/KMSAutoLite.ini
KMSAuto Lite Portable v1.3.5.3/readme_bg.txt
KMSAuto Lite Portable v1.3.5.3/readme_cn.txt
KMSAuto Lite Portable v1.3.5.3/readme_en.txt
KMSAuto Lite Portable v1.3.5.3/readme_ru.txt

Sharing

General

Malware Config

Signatures

Files

Code Sign

75:3e:5c:ef:ec:b6:3d:75:b2:cc:6b:83:03:2f:89:9eCertificate

Extended Key Usages

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0bCertificate

Extended Key Usages

Key Usages

1a:05:da:b8:f0:7a:e8:40:be:ad:78:fe:b2:55:a8:74Certificate

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77Certificate

Extended Key Usages

Key Usages

f2:86:08:ca:e2:5b:ee:b8:69:9c:b4:6c:cb:9d:0e:35:2d:77:d3:de:a3:0d:58:d9:4c:56:d8:39:88:5e:38:d9Signer

66:50:ed:29:d3:ed:1f:fb:8e:fa:2a:cc:21:9f:be:42:c0:8a:7e:91Signer

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 4.4MB

UPX1 Size: 1.6MB - Virtual size: 1.6MB

.rsrc Size: 46KB - Virtual size: 48KB

Code Sign

75:3e:5c:ef:ec:b6:3d:75:b2:cc:6b:83:03:2f:89:9eCertificate

Extended Key Usages

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0bCertificate

Extended Key Usages

Key Usages

1a:05:da:b8:f0:7a:e8:40:be:ad:78:fe:b2:55:a8:74Certificate

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77Certificate

Extended Key Usages

Key Usages

36:57:30:6e:5a:d0:51:25:7d:5f:42:5a:da:44:63:69:d2:2b:4a:42:bc:23:63:ad:10:9b:b4:b1:51:a3:c8:f2Signer

e5:68:ca:50:79:9c:0a:b6:8c:f2:d2:68:20:76:b4:c3:a7:e1:cb:cfSigner

Headers

File Characteristics

Sections

.code Size: 24KB - Virtual size: 120KB

.text Size: 177KB - Virtual size: 376KB

.rdata Size: 21KB - Virtual size: 40KB

.data Size: 1.4MB - Virtual size: 5.2MB

.rsrc Size: 1024B - Virtual size: 48KB

.msfree Size: 49KB - Virtual size: 52KB

.adata Size: - Virtual size: 4KB

75:3e:5c:ef:ec:b6:3d:75:b2:cc:6b:83:03:2f:89:9e
Certificate

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

1a:05:da:b8:f0:7a:e8:40:be:ad:78:fe:b2:55:a8:74
Certificate

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

f2:86:08:ca:e2:5b:ee:b8:69:9c:b4:6c:cb:9d:0e:35:2d:77:d3:de:a3:0d:58:d9:4c:56:d8:39:88:5e:38:d9
Signer

66:50:ed:29:d3:ed:1f:fb:8e:fa:2a:cc:21:9f:be:42:c0:8a:7e:91
Signer

UPX0
Size: - Virtual size: 4.4MB

UPX1
Size: 1.6MB - Virtual size: 1.6MB

.rsrc
Size: 46KB - Virtual size: 48KB

75:3e:5c:ef:ec:b6:3d:75:b2:cc:6b:83:03:2f:89:9e
Certificate

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

1a:05:da:b8:f0:7a:e8:40:be:ad:78:fe:b2:55:a8:74
Certificate

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

36:57:30:6e:5a:d0:51:25:7d:5f:42:5a:da:44:63:69:d2:2b:4a:42:bc:23:63:ad:10:9b:b4:b1:51:a3:c8:f2
Signer

e5:68:ca:50:79:9c:0a:b6:8c:f2:d2:68:20:76:b4:c3:a7:e1:cb:cf
Signer

.code
Size: 24KB - Virtual size: 120KB

.text
Size: 177KB - Virtual size: 376KB

.rdata
Size: 21KB - Virtual size: 40KB

.data
Size: 1.4MB - Virtual size: 5.2MB

.rsrc
Size: 1024B - Virtual size: 48KB

.msfree
Size: 49KB - Virtual size: 52KB

.adata
Size: - Virtual size: 4KB