socelars | 9ef9e29a93154b3c7c87191972f20f44_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

9ef9e29a93154b3c7c87191972f20f44_JaffaCakes118
Size

455KB
MD5

9ef9e29a93154b3c7c87191972f20f44
SHA1

21e9361f341c552baaba6fea8e9a63e87a591148
SHA256

92c1617d281a547fb7dc3e086f27d268d6cb09d1477ea5087e39eb164d451d62
SHA512

93cf0776ea78abc5c864e317016cef84b12558adb6bcca174ec8081d507db7fc0e7dddfae4e618811c0158bdbe70d805afd6a0cf5fee834fd27cdb8dc86b1a4b
SSDEEP

12288:pTOnjV+iILZRqTPljGeZNb19En63N9020WK4AvrXYZ:y0DQjZ0YKY

Score

10^/10

upx socelars

Malware Config

Extracted

Family

socelars

http://www.frivoloument.com/index.php/

Signatures

Socelars family
socelars

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
unpack001/out.upx

Files

9ef9e29a93154b3c7c87191972f20f44_JaffaCakes118
.exe windows:6 windows x86 arch:x86

Code Sign

13:99:8b:94:80:8c:01:75:b9:4c:67:ff:89:8e:45:bf
Certificate

Issuer

CN=Microsoft Corporation

Not Before

26-12-2018 02:28

Not After

31-12-2039 23:59

Subject

CN=Microsoft Corporation

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08-08-2009 01:00

Not After

08-08-2024 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5e:68:d6:11:71:94:63:50:56:00:68:f3:3e:c9:c5:91
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08-08-2009 01:00

Not After

08-08-2039 01:00

Subject

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

b2:ce:de:4f:10:c2:7d:65:e7:8e:1f:0c:fe:7f:35:22:c3:12:a0:3b
Signer

Actual PE Digest

b2:ce:de:4f:10:c2:7d:65:e7:8e:1f:0c:fe:7f:35:22:c3:12:a0:3b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 624KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 445KB - Virtual size: 448KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 840KB - Virtual size: 840KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.zzzstuc
Size: 512B - Virtual size: 138B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.zzzstuc
Size: 1024B - Virtual size: 634B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.protect
Size: 512B - Virtual size: 403B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.dududu1
Size: 1024B - Virtual size: 675B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.dgdg44
Size: 512B - Virtual size: 42B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.dgdg22
Size: 512B - Virtual size: 121B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.dugdug3
Size: 1024B - Virtual size: 774B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.daada33
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.dadaa11
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.ddada22
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 116KB - Virtual size: 115KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

Code Sign

13:99:8b:94:80:8c:01:75:b9:4c:67:ff:89:8e:45:bfCertificate

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4cCertificate

Extended Key Usages

Key Usages

5e:68:d6:11:71:94:63:50:56:00:68:f3:3e:c9:c5:91Certificate

Key Usages

b2:ce:de:4f:10:c2:7d:65:e7:8e:1f:0c:fe:7f:35:22:c3:12:a0:3bSigner

Headers

DLL Characteristics

File Characteristics

Sections

UPX0 Size: - Virtual size: 624KB

UPX1 Size: 445KB - Virtual size: 448KB

.rsrc Size: 1024B - Virtual size: 4KB

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 840KB - Virtual size: 840KB

.zzzstuc Size: 512B - Virtual size: 138B

.zzzstuc Size: 1024B - Virtual size: 634B

.protect Size: 512B - Virtual size: 403B

.dududu1 Size: 1024B - Virtual size: 675B

.dgdg44 Size: 512B - Virtual size: 42B

.dgdg22 Size: 512B - Virtual size: 121B

.dugdug3 Size: 1024B - Virtual size: 774B

.daada33 Size: 2KB - Virtual size: 1KB

.dadaa11 Size: 1KB - Virtual size: 1KB

.ddada22 Size: 2KB - Virtual size: 1KB

.rdata Size: 116KB - Virtual size: 115KB

.data Size: 8KB - Virtual size: 15KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 26KB - Virtual size: 26KB

13:99:8b:94:80:8c:01:75:b9:4c:67:ff:89:8e:45:bf
Certificate

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

5e:68:d6:11:71:94:63:50:56:00:68:f3:3e:c9:c5:91
Certificate

b2:ce:de:4f:10:c2:7d:65:e7:8e:1f:0c:fe:7f:35:22:c3:12:a0:3b
Signer

UPX0
Size: - Virtual size: 624KB

UPX1
Size: 445KB - Virtual size: 448KB

.rsrc
Size: 1024B - Virtual size: 4KB

.text
Size: 840KB - Virtual size: 840KB

.zzzstuc
Size: 512B - Virtual size: 138B

.zzzstuc
Size: 1024B - Virtual size: 634B

.protect
Size: 512B - Virtual size: 403B

.dududu1
Size: 1024B - Virtual size: 675B

.dgdg44
Size: 512B - Virtual size: 42B

.dgdg22
Size: 512B - Virtual size: 121B

.dugdug3
Size: 1024B - Virtual size: 774B

.daada33
Size: 2KB - Virtual size: 1KB

.dadaa11
Size: 1KB - Virtual size: 1KB

.ddada22
Size: 2KB - Virtual size: 1KB

.rdata
Size: 116KB - Virtual size: 115KB

.data
Size: 8KB - Virtual size: 15KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 26KB - Virtual size: 26KB