b3c2941f9d381671e862cec83c790c6b_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

b3c2941f9d381671e862cec83c790c6b_JaffaCakes118
Size

2.0MB
MD5

b3c2941f9d381671e862cec83c790c6b
SHA1

54f8b97058683a9bf087391cb6c23b64aadc9afb
SHA256

12e0b4cbf98083be45581a548999e1acfd9f7db056e50315d807cfa988c16297
SHA512

744141658de6d04caeaaa3a45e6c358c9c383c9d86ff188e036d054821af7977df184d152710889d9ba2fc6e8700c46f558b6b9aabc1dd1bc11907e1d8071d89
SSDEEP

49152:sPuhuncE6QTbYUOhoMQTIYNezWmQu1Aqf:sQ4f0Thf

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/out.upx

Files

b3c2941f9d381671e862cec83c790c6b_JaffaCakes118
.exe windows:5 windows x86 arch:x86

Code Sign

79:52:cf:d9:ef:04:0b:59:f3:c1:40:ba:1d:a9:7a:60
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

05-06-2012 00:00

Not After

08-05-2013 23:59

Subject

CN=Vittalia Internet S.L.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Vittalia Internet S.L.,L=Mostoles,ST=Madrid,C=ES

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3c:91:31:cb:1f:f6:d0:1b:0e:9a:b8:d0:44:bf:12:be
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

29-01-1996 00:00

Not After

02-08-2028 23:59

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

e6:cf:ca:f2:d0:d5:09:6c:fd:9d:d5:8c:1a:ea:39:54:6c:62:fa:d8
Signer

Actual PE Digest

e6:cf:ca:f2:d0:d5:09:6c:fd:9d:d5:8c:1a:ea:39:54:6c:62:fa:d8

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 260KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 141KB - Virtual size: 144KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 11KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 174KB - Virtual size: 173KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 49KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 112KB - Virtual size: 111KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

79:52:cf:d9:ef:04:0b:59:f3:c1:40:ba:1d:a9:7a:60Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fdCertificate

Extended Key Usages

Key Usages

3c:91:31:cb:1f:f6:d0:1b:0e:9a:b8:d0:44:bf:12:beCertificate

e6:cf:ca:f2:d0:d5:09:6c:fd:9d:d5:8c:1a:ea:39:54:6c:62:fa:d8Signer

Headers

DLL Characteristics

File Characteristics

Sections

UPX0 Size: - Virtual size: 260KB

UPX1 Size: 141KB - Virtual size: 144KB

.rsrc Size: 11KB - Virtual size: 12KB

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 174KB - Virtual size: 173KB

.rdata Size: 49KB - Virtual size: 48KB

.data Size: 7KB - Virtual size: 15KB

.rsrc Size: 112KB - Virtual size: 111KB

.reloc Size: 36KB - Virtual size: 35KB

79:52:cf:d9:ef:04:0b:59:f3:c1:40:ba:1d:a9:7a:60
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

3c:91:31:cb:1f:f6:d0:1b:0e:9a:b8:d0:44:bf:12:be
Certificate

e6:cf:ca:f2:d0:d5:09:6c:fd:9d:d5:8c:1a:ea:39:54:6c:62:fa:d8
Signer

UPX0
Size: - Virtual size: 260KB

UPX1
Size: 141KB - Virtual size: 144KB

.rsrc
Size: 11KB - Virtual size: 12KB

.text
Size: 174KB - Virtual size: 173KB

.rdata
Size: 49KB - Virtual size: 48KB

.data
Size: 7KB - Virtual size: 15KB

.rsrc
Size: 112KB - Virtual size: 111KB

.reloc
Size: 36KB - Virtual size: 35KB