911f4d53f6fce8c681e654042914e9c8_JaffaCakes118

General

Target
911f4d53f6fce8c681e654042914e9c8_JaffaCakes118
Size 198KB
Sample240603-kda14aad46
SHA256 8380b8aac0e4c16f62709ea1673b85be3d604eaffb0279277e7bb37a78dea3c8
MD5 911f4d53f6fce8c681e654042914e9c8
SHA1 5c8f180d5ff8247ff44a57ec410e3f144be5d265
SHA512 48ebf6d1439c6ba3dde69755cfdc93038c5fc2b33e9db6d3ed9f12f3702d356ece54abf21e25ccadc4306c6c18836c49d23c80d2311bbe5ae058787e4519cd3d
SSDEEP 3072:cIFhgFW5uGvGfrLlOgrb/ZU5X8zkS3m/u13n3X8lt/vAzGtqyGgwiaOtNW8iyqPL:cIyXGs/fRBT3m/0ncYGQgwiagNW/P
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
static1/unpack001/Mensagem de voz.mp3.cpl	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/Mensagem de voz.mp3.cpl	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Mensagem de voz.mp3.cpl
unpack002/out.upx

File Explorer

911f4d53f6fce8c681e654042914e9c8_JaffaCakes118

.zip 198KB
Mensagem de voz.mp3.cpl

.dll 204KB
out.upx

.dll 504KB

911f4d53f6fce8c681e654042914e9c8_JaffaCakes118

SHA256 8380b8aac0e4c16f62709ea1673b85be3d604eaffb0279277e7bb37a78dea3c8
MD5 911f4d53f6fce8c681e654042914e9c8
SHA1 5c8f180d5ff8247ff44a57ec410e3f144be5d265
SHA512 48ebf6d1439c6ba3dde69755cfdc93038c5fc2b33e9db6d3ed9f12f3702d356ece54abf21e25ccadc4306c6c18836c49d23c80d2311bbe5ae058787e4519cd3d
SSDEEP 3072:cIFhgFW5uGvGfrLlOgrb/ZU5X8zkS3m/u13n3X8lt/vAzGtqyGgwiaOtNW8iyqPL:cIyXGs/fRBT3m/0ncYGQgwiagNW/P
MD5 SHA1 SHA512 SSDEEP

Mensagem de voz.mp3.cpl

SHA256 5ae3b774165e93198a45af01c3950e957028596b3abb2177fbd54b52c79c43da
MD5 d7dd8961b5af364f6a08638dae98f958
SHA1 fe40eb9edc9dc80fccc5e56b4dc873453ff4fec1
SHA512 3aa33bf06a321eb7fa30c650f6119702fe13004479f5fcfbe6266b19d640cf54c33b4abcd1537224e154115f06986875c944814544faa39ac8c0688033df1954
SSDEEP 6144:zUytxlQmVp8Qh5cZ5gDUErlUmldW+LG8lTW:wyt7QmD8gcPguA7Jl
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

567232

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

out.upx

SHA256 0f1becbfcf6a12d85549d2410e8431c98323f5e8d29e968119be8bc45f1bbcd8
MD5 de299f607184262b859f7ccfc3ced7fd
SHA1 6138e4f57276eedb968fe3612da87a348334c140
SHA512 c6e88ba5f4968179f93a6f2d577386586f27457c3330733eaac351e5701d06f37b45e9a67dd5985e377cf7f20e96fd084b9075afc58a8d10a07b953bee83d8fa
SSDEEP 6144:wU7pIWjuMR+1UQWIS75QB4CZWZSlJUU7hgQwQYfq7bWUrtL4E+fL2y0JCEgaR2Vl:BBjuMR+1Ujp7yF9elgbWUsC5JJgam
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

439196

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

425KB

Virtual Size

424KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

5KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

67B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

33KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

28KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

911f4d53f6fce8c681e654042914e9c8_JaffaCakes118

Mensagem de voz.mp3.cpl

generic

out.upx

generic

Sharing

General

Malware Config

Signatures

File Explorer

911f4d53f6fce8c681e654042914e9c8_JaffaCakes118

Mensagem de voz.mp3.cpl

generic

out.upx

generic