xmrig | 9a76c60533aa3add7377b3e9242b4b9e_JaffaCakes118

resource	yara_rule
static1/unpack001/out.upx	xmrig

resource	yara_rule
sample	upx

resource
9a76c60533aa3add7377b3e9242b4b9e_JaffaCakes118
unpack001/out.upx

9a76c60533aa3add7377b3e9242b4b9e_JaffaCakes118

SHA256 f2b43a7dad8e025832267d2669e1417626351c4402a2602f049f9fc5eaf3f727
MD5 9a76c60533aa3add7377b3e9242b4b9e
SHA1 cbd2f81d8c0d66c8579b752970cdb8e295e03268
SHA512 38ffa17b740326c5b629a39e1b389385733406dfe3a901b4ce2b55180339dacc20a658e59b3569e77670d4e75517bd20d8d63d05e06bc9f006b677dc0fed88b3
SSDEEP 24576:M8vZNZ+74xnU508TmE984HgqiczONC85P4BMPjBpne:Vd+7UU508TmE9hAqgM8NWIjBg
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4660560

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

.rsrc/0/MANIFEST/1

SHA256 d2fd169a03234f2411c92aa4e6026b2f401ea6dde15416153bf75b0e0659ccf7
MD5 2758750a0f081e1f055fafa91ea052fc
SHA1 f99cd0fe0f1cb03dc7b937a34411ee08abbfb301
SHA512 3357a7938c7a8431e45399539943b684788943724b2fe16aa85092c7874a95fd24234cb1e194c7242a96d39a0aacd81456cfdcb9507d9543382efb7db0d56c4c
MD5 SHA1 SHA512

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/1033/GROUP_ICON/101

SHA256 4a2d022975e1b62b89e1e757b73f563b68b21b71edf8cac8dbbf062b2cb2d2fe
MD5 fc8846589a152507308beb48ead7a796
SHA1 787c24f9fbf50523b34bcb328ed56d33c4e7ffd7
SHA512 f302d8d704d73a2867c29fdc457228fcf03b6f69fca28d861685a91da05c7f919da9862d1235b8b14332f0e3398cb59722d82950beee113a2eb3a45f5418c649
MD5 SHA1 SHA512

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/1033/ICON/1.ico

SHA256 987065c907ff6fdb133630ae28e29efc2cc1ab4fad621b663884e2a0245e61a1
MD5 7840b51359ec3fc54c83714cbcc9be95
SHA1 fe569f57565a9788292f87eb9eb9d44defafe202
SHA512 9bf5b56aaede0a8efeff6434ab1c8734bbd143ef0fc76afbd5add017e7d5787da10a9278f279a3f5b287eab3f52fbb67086f5d258d406135519a6977707f013e
MD5 SHA1 SHA512

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/1033/ICON/2.ico

SHA256 894a417afcf3d0578c3f91da003b4b7cfb92f0e56cd64fb14866c348a081ca97
MD5 14f316b53a2fe3882ace32fd6cefffa7
SHA1 a1270fa069b473f86c486c47d7e901b73ce82520
SHA512 adccf5faa79ea6c256aa9ad0a1cf8bb7d1d0e26fd8a30abf6d5cecc10c7ed9b25c09c4ace496c1c0fb65d11011e7b13f327b277ed1336bf3f1b94a1db9366411
MD5 SHA1 SHA512

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/1033/ICON/3.ico

SHA256 e8037597193eadfa52cdcd44185b15acb174142cd362ea0be1dc1548a8671eec
MD5 13208bd63976bb1cad78ffe7e5dec96b
SHA1 21242ae08b76ae0699f3cedbd1d40c36a99d1adf
SHA512 6694a748d2e00a437f50045c9c6a0a74bd367812ca4fe757ebfaa4747a36a3f0772bdc1cefa6a06b41f5e8ee55d8efb47d829f6e267d410a19198fc124c27ed5
MD5 SHA1 SHA512

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/1033/ICON/4.ico

SHA256 6ab2c84aa7d0c905f44acb277ecff60dace6c35ae2646f036e70837bf1df0f83
MD5 c2582e0d4d8b839a6ff31b167e9adc97
SHA1 adba4aafd8710a2e5589eb569ee7a1dfa188ea97
SHA512 78818110d9c5ff86f688edff81f857972b0281db8732d04ba426a0916c86b4b0713ca7f164ae4705833836c7517eede060905b9696951560ba4294ef54b993fc
SSDEEP 192:tOvYlaRHaKNxtLcuVB4gTiKViMiiiiZiiioiQYu7:GYlO6KNjLlT2u7
MD5 SHA1 SHA512 SSDEEP

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/1033/ICON/5.ico

SHA256 3155303ed81ee768299996afc60f54bef1d65687a1bef3ee572af19be53143f5
MD5 35443ac2991cbdd1b11bd165929d2ca9
SHA1 a69fd54d141325801f30da2b04fe09ba1dfc095a
SHA512 7768fd895eff2bed042e8a49242b3c94f6a9b05d04e97b58614874310eb5167057aec975ef5ca6f965cbf4b6bab51ee858559986c76e8c8f367b503761d2c7cd
SSDEEP 48:Wfc4Was/pV8LZd18LRjvzMKsIBMAhqn9O6sHiBOuqFewZ:LFasBm9v8diIBZhq0HiBO5F9Z
MD5 SHA1 SHA512 SSDEEP

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/1033/ICON/6.ico

SHA256 279e1d7f2c83e5832d08683b9ed34a766892650c8453ba1f205cbeb9e5253013
MD5 0f71faa787aa501935ab664f466ec13c
SHA1 87c75fd2b5f1b9c2cdcd4f874bba6d9edbda6784
SHA512 cd2cb49764ea75773f5056385fc276d655f5087d072a00546e7882670f8878b646783ac1e767ee0994d821d716db4cac2b34eeab11c50c3288174b779a7e19f4
MD5 SHA1 SHA512

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc/1033/version.txt

SHA256 032b6a8760809d96d175637c9bc77468f1c1987db9b0c5f3d0fb8641a4bfbeb8
MD5 fba605b91243ea6d809483586df84145
SHA1 4d93066e68d5d0984ddba452c00def3d37bf6e59
SHA512 3dee8744d72bf720c12f7ba3746bb62cd270925e797eb138c7f4c2ff322690b0d595cbfca0c8538cc34b09a80487696635d1257898cb00163ef7a852e44fdd3e
MD5 SHA1 SHA512

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

.rsrc_1

SHA256 a694e70d48391721f912e134f6a4ef822d3a9ed9c5f44802e77df00e0fcecd7a
MD5 71dbeb766d42490efb1e25b4a0672693
SHA1 55fbcfd31a819181fc4204c1ee7a194c4786a46f
SHA512 efdbe8e3c9711fc26c133e4d6a6532ae1568effe9e57360f032180ed30ed9e31317a13d7253f57ab57adc1bf1ba935a0ca251793b8c91f10931b974870154da1
MD5 SHA1 SHA512

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

UPX1

SHA256 281c696bb669b17c77d52d017362f5df1757bc03cccc27227b1078316ff1f5fb
MD5 39b9edc03934d6411a6df16f223cc7eb
SHA1 53f4208c035cf1c9001f4bb7129e4f40ef5a5fc9
SHA512 14312f7c3b9cc68336733c7f0e030fb7802a5a4cb6940d97ab51066ccf2a877399c99488a371602336bf60921bf701ba3d33cd7f8dc1c11c38b5d86baba0376e
SSDEEP 24576:68vZNZ+74xnU508TmE984HgqiczONC85P4BMPjBpn:Ld+7UU508TmE9hAqgM8NWIjB
MD5 SHA1 SHA512 SSDEEP

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

out.upx

SHA256 ef2406125924d790179c1660305d638ca748243fd202113b7e93a19fcb870772
MD5 14fa24c7178dc717e4686044854ea422
SHA1 4877b55c594b98ec7b39bfc3b091d16173073cd7
SHA512 e3248cf043d7a179d168c22b8c0a95c880bc38424d679e0bb09c2ccff5d3e4be7df0861c9908efca25fce9916ef169bc2c0bb896120daff9f9b62eba52684ae2
SSDEEP 98304:TRF+GA7R+afsMveTDN6US+8B4JZZACYrsa5:mGANzmTDN6UOBIZACYrs
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

XMRig Miner payload

miner
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5376

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

3.0MB

Virtual Size

3.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

214KB

Virtual Size

213KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

170KB

Virtual Size

169KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

447KB

Virtual Size

446KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

536KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

24KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

9a76c60533aa3add7377b3e9242b4b9e_JaffaCakes118

generic

.rsrc/0/MANIFEST/1

.rsrc/1033/GROUP_ICON/101

.rsrc/1033/ICON/1.ico

.rsrc/1033/ICON/2.ico

.rsrc/1033/ICON/3.ico

.rsrc/1033/ICON/4.ico

.rsrc/1033/ICON/5.ico

.rsrc/1033/ICON/6.ico

.rsrc/1033/version.txt

.rsrc_1

UPX1

out.upx

generic

Sharing

General

Malware Config

Signatures

File Explorer

9a76c60533aa3add7377b3e9242b4b9e_JaffaCakes118

generic

.rsrc/0/MANIFEST/1

.rsrc/1033/GROUP_ICON/101

.rsrc/1033/ICON/1.ico

.rsrc/1033/ICON/2.ico

.rsrc/1033/ICON/3.ico

.rsrc/1033/ICON/4.ico

.rsrc/1033/ICON/5.ico

.rsrc/1033/ICON/6.ico

.rsrc/1033/version.txt

.rsrc_1

UPX1

out.upx

generic