a38e9d412d2482e12caa4d8b5f42cab2_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
a38e9d412d2482e12caa4d8b5f42cab2_JaffaCakes118
Size 2.0MB
Sample240613-c4vjes1frd
SHA256 a92a3379e70d2d39cf63ac6c8d9ee8bedc9a27b3110c05d20cc55d99f33455e4
MD5 a38e9d412d2482e12caa4d8b5f42cab2
SHA1 4568473f4e4c289a8cc61c3391e8d61a975c4df1
SHA512 583f29065108d0b386d909fae8e8521a848499e25b20d8aeaa2aed4fa48272a7b7ef8ee6fb131385867fe1f1f58a4310e45efe5004a21d5d8f2707c091b9b26e
SSDEEP 49152:0/Ci1xUH/12E65ZmzrPghfrku03woUe1X:0/t1WHN2EyZgPghrku03wYV
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

File Explorer

a38e9d412d2482e12caa4d8b5f42cab2_JaffaCakes118

.exe 2.0MB

a38e9d412d2482e12caa4d8b5f42cab2_JaffaCakes118

SHA256 a92a3379e70d2d39cf63ac6c8d9ee8bedc9a27b3110c05d20cc55d99f33455e4
MD5 a38e9d412d2482e12caa4d8b5f42cab2
SHA1 4568473f4e4c289a8cc61c3391e8d61a975c4df1
SHA512 583f29065108d0b386d909fae8e8521a848499e25b20d8aeaa2aed4fa48272a7b7ef8ee6fb131385867fe1f1f58a4310e45efe5004a21d5d8f2707c091b9b26e
SSDEEP 49152:0/Ci1xUH/12E65ZmzrPghfrku03woUe1X:0/t1WHN2EyZgPghrku03wYV
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

Digest

d8:18:a6:3b:c4:b4:56:c4:42:3f:e2:f8:1b:b2:90:fe:ce:c9:b0:b6:d0:2f:d9:c2:f5:76:82:4b:c6:b2:22:fc

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=BitTorrent Inc,O=BitTorrent Inc,L=San Francisco,ST=California,C=US

Chains

Jun 12, 2020

CN=BitTorrent Inc,O=BitTorrent Inc,L=San Francisco,ST=California,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Digest

fd:6d:c1:43:79:71:7a:b8:db:11:a2:b5:fd:35:87:e2:18:aa:ee:f8

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=BitTorrent Inc,O=BitTorrent Inc,L=San Francisco,ST=California,C=US

Chains

Jun 12, 2020

CN=BitTorrent Inc,O=BitTorrent Inc,L=San Francisco,ST=California,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=BitTorrent Inc,O=BitTorrent Inc,L=San Francisco,ST=California,C=US

Serial Number

6f:13:bc:d5:09:63:d2:f3:09:43:9e:37:fd:45:9c:7c

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 4, 2019 - Dec 16, 2022

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:2f:4e:e1:52:d7

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 13, 2011 - Jan 28, 2028

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Serial Number

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 24, 2016 - Jun 24, 2027

Subject

CN=BitTorrent Inc,O=BitTorrent Inc,L=San Francisco,ST=California,C=US

Serial Number

6f:13:bc:d5:09:63:d2:f3:09:43:9e:37:fd:45:9c:7c

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 4, 2019 - Dec 16, 2022

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Entrust Time Stamping Authority,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

Serial Number

2b:b1:74:16:9b:8c:42:56:00:00:00:00:55:91:e9:0e

Issuer

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 5, 2018 - Jan 5, 2030

Subject

Serial Number

58:da:13:ff:00:00:00:00:51:ce:0d:f7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 22, 2015 - Jun 22, 2029

Minor OS version

Major OS version

Entry point

5407872

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

generic

count=26, id=241, version=40116,

count=198, id=243, version=40116,

count=34, id=242, version=40116,

count=2, id=261, version=23013,

count=2, id=199, version=41118,

count=26, id=259, version=24123,

count=124, id=261, version=24123,

count=44, id=260, version=24123,

count=1, id=10, productName=VS98 (6.0) build 8168, version=8168,

count=4, id=14, version=7299,

count=35, id=265, version=24215,

count=203, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=16, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=41, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=747, id=1, productName=Unmarked objects,

count=379, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=3, id=151,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,