bb82d377a9dab0e5e7a3784ac325709f_JaffaCakes118

General

Target
bb82d377a9dab0e5e7a3784ac325709f_JaffaCakes118
Size 384KB
Sample240618-msn8datgqk
SHA256 47b04692ea59633e0f28237707b098448d0b19111612162ffd515d071720f0e1
MD5 bb82d377a9dab0e5e7a3784ac325709f
SHA1 a8050d9452ef82f06ba0988b425ce5c4fb2d7300
SHA512 1243e226b4de419d704c6e40b766040ca86a323397329684dc48052d0f4f9fd0c0f4e7a8bea0cc69313cc269736d250e5cf854b0e8e1834ee2dc73cf60a16971
SSDEEP 6144:ugwAp7Yg2o6KCmnSOOuBfepQOgUvv46RV//F1k9onhTRNuixsAf1vDPLiue9sCHE:uglYqtSgdUQOgw5VXF1kuhT4s1LLaE
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/payment advice.exe	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/payment advice.exe
unpack002/out.upx

File Explorer

bb82d377a9dab0e5e7a3784ac325709f_JaffaCakes118

.zip 384KB
payment advice.exe

.exe 392KB
out.upx

.exe 778KB

bb82d377a9dab0e5e7a3784ac325709f_JaffaCakes118

SHA256 47b04692ea59633e0f28237707b098448d0b19111612162ffd515d071720f0e1
MD5 bb82d377a9dab0e5e7a3784ac325709f
SHA1 a8050d9452ef82f06ba0988b425ce5c4fb2d7300
SHA512 1243e226b4de419d704c6e40b766040ca86a323397329684dc48052d0f4f9fd0c0f4e7a8bea0cc69313cc269736d250e5cf854b0e8e1834ee2dc73cf60a16971
SSDEEP 6144:ugwAp7Yg2o6KCmnSOOuBfepQOgUvv46RV//F1k9onhTRNuixsAf1vDPLiue9sCHE:uglYqtSgdUQOgw5VXF1kuhT4s1LLaE
MD5 SHA1 SHA512 SSDEEP

payment advice.exe

SHA256 3c487a339e74d376137c0ffd86a0f6b693035f4b01f8844bbf1d09f0f9164d91
MD5 4a28ef4e797232288e853fec1faa25df
SHA1 0d752a5d84e669259cb3386914c94ca6ff65470a
SHA512 174531188f089eb47d7a2e2fcaf3849202f22fff45871b231961142c793d9ca6276b57244d0f3b7a4183fe4a9b1ab4fe704b70206de61197d5d64805ab51f252
SSDEEP 12288:bltul+kX9phARKGOwm8HzjMA0Z6Ys+9lJI72pfWtGa:b72+kXeRhC6HMAOFLw2wn
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

833920

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

out.upx

SHA256 1a259daf93f7be2165257d4f3e05c31eeb3859ff863ca74cecc8662c848da302
MD5 cbe25633b14ebabc85de8dc976a3781f
SHA1 77c8bf1142c1855be3b23d9ff0d1c262b6d1ee5e
SHA512 2baeb309d8f7605336f006396df0dda45ec2145809f1315a9336ef09654609c6604af831522f266befd6afd80a86dfd2edd66aeafd4ee54a5948ff09f9ce47b1
SSDEEP 12288:SUz1uCCXme15cfis/siUVE8KMPLeXCCwyx2AYAHtUPQFlm0oJSvH3CpdMg:Szncqs/siUVE8FPL1yx2ACIitSvHl
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

279072

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

bb82d377a9dab0e5e7a3784ac325709f_JaffaCakes118

payment advice.exe

generic

out.upx

generic

Sharing

General

Malware Config

Signatures

File Explorer

bb82d377a9dab0e5e7a3784ac325709f_JaffaCakes118

payment advice.exe

generic

out.upx

generic