2fa6178d565231c44b043062890ac23d_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

2fa6178d565231c44b043062890ac23d_JaffaCakes118
Size

242KB
MD5

2fa6178d565231c44b043062890ac23d
SHA1

e7e7fbffd71222f178a2ee88f46743876344ff31
SHA256

7869ea84e5e24501a2590239d0980c121b0253e6a72b9dadfd18fe38e0b563bb
SHA512

ffeb5afadc1e07503e8b9c7ae12276e1f748d6e0fc35321037bac8fb883f6bce2c0c27ae5c15798501bc5988bd908b3e2d47903de77394f74acae6cdb342da78
SSDEEP

6144:cTBn7wrxHHTVo/1bX28qO9nSBBUBpZbs8m:cd7w9H5a2dOlSBBAbsd

Score

7^/10

vmprotect upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Files

2fa6178d565231c44b043062890ac23d_JaffaCakes118
.exe windows:4 windows x86 arch:x86

b7e9849d1ac493c1166ecc70b6d0e2ea

Code Sign

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08-08-2009 01:00

Not After

08-08-2024 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

46:c1:8f:66:01:63:3d:ae:52:ff:d9:a4:fa:16:2f:40
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

19-11-2013 00:00

Not After

09-02-2017 23:59

Subject

CN=BEIJING QIYI CENTURY SCIENCE&TECHNOLOGY CO.\,LTD.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=TECHNOLOGY PRODUCTS DEPARTMENT,O=BEIJING QIYI CENTURY SCIENCE&TECHNOLOGY CO.\,LTD.,L=BEIJING,ST=BEIJING,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

22:6d:8c:6d:05:1a:5b:53:db:95:04:11:a2:a2:c0:5e
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

31-12-2015 00:00

Not After

09-02-2017 23:59

Subject

CN=BEIJING QIYI CENTURY SCIENCE&TECHNOLOGY CO.\,LTD.,OU=TECHNOLOGY PRODUCTS DEPARTMENT,O=BEIJING QIYI CENTURY SCIENCE&TECHNOLOGY CO.\,LTD.,L=BEIJING,ST=BEIJING,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08-08-2009 01:00

Not After

08-08-2024 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

68:d4:62:63:a4:7f:b4:66:1f:0e:2f:98:b8:35:e8:bf:c6:31:d8:0c:4a:8f:1c:b0:b1:56:1a:41:e3:3c:6f:73
Signer

Actual PE Digest

68:d4:62:63:a4:7f:b4:66:1f:0e:2f:98:b8:35:e8:bf:c6:31:d8:0c:4a:8f:1c:b0:b1:56:1a:41:e3:3c:6f:73

Digest Algorithm

sha256

PE Digest Matches

false

76:32:68:6a:7b:36:78:74:28:ff:ca:dc:63:97:9b:2e:f8:d9:ad:a7
Signer

Actual PE Digest

76:32:68:6a:7b:36:78:74:28:ff:ca:dc:63:97:9b:2e:f8:d9:ad:a7

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess

advapi32

RegCloseKey

comctl32

ord17

comdlg32

GetFileTitleA

gdi32

Escape

ole32

OleInitialize

oleaut32

SysFreeString

oledlg

ord8

olepro32

ord253

user32

GetDC
MessageBoxA

winspool.drv

ClosePrinter

Sections

UPX0
Size: - Virtual size: 352KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: - Virtual size: 176KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 225KB - Virtual size: 224KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 120B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b7e9849d1ac493c1166ecc70b6d0e2ea

Code Sign

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4cCertificate

Extended Key Usages

Key Usages

46:c1:8f:66:01:63:3d:ae:52:ff:d9:a4:fa:16:2f:40Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

22:6d:8c:6d:05:1a:5b:53:db:95:04:11:a2:a2:c0:5eCertificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4cCertificate

Extended Key Usages

Key Usages

68:d4:62:63:a4:7f:b4:66:1f:0e:2f:98:b8:35:e8:bf:c6:31:d8:0c:4a:8f:1c:b0:b1:56:1a:41:e3:3c:6f:73Signer

76:32:68:6a:7b:36:78:74:28:ff:ca:dc:63:97:9b:2e:f8:d9:ad:a7Signer

Headers

File Characteristics

Imports

kernel32

advapi32

comctl32

comdlg32

gdi32

ole32

oleaut32

oledlg

olepro32

user32

winspool.drv

Sections

UPX0 Size: - Virtual size: 352KB

UPX1 Size: - Virtual size: 176KB

.rsrc Size: 4KB - Virtual size: 8KB

.vmp0 Size: - Virtual size: 11KB

.vmp1 Size: 225KB - Virtual size: 224KB

.reloc Size: 512B - Virtual size: 120B

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

46:c1:8f:66:01:63:3d:ae:52:ff:d9:a4:fa:16:2f:40
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

22:6d:8c:6d:05:1a:5b:53:db:95:04:11:a2:a2:c0:5e
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

68:d4:62:63:a4:7f:b4:66:1f:0e:2f:98:b8:35:e8:bf:c6:31:d8:0c:4a:8f:1c:b0:b1:56:1a:41:e3:3c:6f:73
Signer

76:32:68:6a:7b:36:78:74:28:ff:ca:dc:63:97:9b:2e:f8:d9:ad:a7
Signer

UPX0
Size: - Virtual size: 352KB

UPX1
Size: - Virtual size: 176KB

.rsrc
Size: 4KB - Virtual size: 8KB

.vmp0
Size: - Virtual size: 11KB

.vmp1
Size: 225KB - Virtual size: 224KB

.reloc
Size: 512B - Virtual size: 120B