074b6a860107255b3badf16085567144_JaffaCakes118

General

Target
074b6a860107255b3badf16085567144_JaffaCakes118
Size 91KB
Sample240620-sw9alsvbrf
SHA256 843041d5051fa340fcfc292bab93902fba1d1f252918fc2ae2a29651280708c0
MD5 074b6a860107255b3badf16085567144
SHA1 880e7888c8dca76957aad36085afa5ed86db8564
SHA512 f4a9c669d44ca5616bb779e3a026e490aab29ddb1f01451ed5f49442b0c827ef29fd13516c5690bcc484f73b54a2e2fee4d899bd3d8078603bdbb01c14c7a493
SSDEEP 1536:vH+rCSzfLHXI/fhdXLtn/6STsp7aVvOog6BKzw+A/qT24vKHGqSI8pPr2anDN:vehzz3Shd7t/6+spekzlTdvKHJTkFx
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
sample	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
074b6a860107255b3badf16085567144_JaffaCakes118
unpack001/out.upx

File Explorer

074b6a860107255b3badf16085567144_JaffaCakes118

.dll 91KB
out.upx

.dll 208KB

074b6a860107255b3badf16085567144_JaffaCakes118

SHA256 843041d5051fa340fcfc292bab93902fba1d1f252918fc2ae2a29651280708c0
MD5 074b6a860107255b3badf16085567144
SHA1 880e7888c8dca76957aad36085afa5ed86db8564
SHA512 f4a9c669d44ca5616bb779e3a026e490aab29ddb1f01451ed5f49442b0c827ef29fd13516c5690bcc484f73b54a2e2fee4d899bd3d8078603bdbb01c14c7a493
SSDEEP 1536:vH+rCSzfLHXI/fhdXLtn/6STsp7aVvOog6BKzw+A/qT24vKHGqSI8pPr2anDN:vehzz3Shd7t/6+spekzlTdvKHJTkFx
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

251456

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

out.upx

SHA256 62ac7b4a294ebf3bce8aad38b8d0408a3a0a84a9a09fa6b665a17f03e76d5c44
MD5 15607ec40285cd5c921c6ebc8689bbab
SHA1 c929561944411462509af18656ce3e28f85e4b7f
SHA512 b0df667bf5df33b66357ad4e76deb15c37aca9fff2a91c10dd7cc4e831ee74d59fdca39e19e92bcd3abfe88f1c58c6c720fd1099017817771eb64bb66b9d2c1e
SSDEEP 3072:tq2PXVJOgFtzcNLsEmmVV+M27SKcmvhfW6+GFsL1Jcm6q+RH:02PjhF5cNtVVUpff+4kJ/
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

184680

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

176KB

Virtual Size

176KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

184B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

074b6a860107255b3badf16085567144_JaffaCakes118

generic

out.upx

generic

Sharing

General

Malware Config

Signatures

File Explorer

074b6a860107255b3badf16085567144_JaffaCakes118

generic

out.upx

generic