383970aeee89904841849906839ef7e4_JaffaCakes118

General

Target

383970aeee89904841849906839ef7e4_JaffaCakes118
Size

265KB
MD5

383970aeee89904841849906839ef7e4
SHA1

da70eafa41bf4f3b90d9f925e55afe5d5d116bd4
SHA256

c3b55438e789559f5d7f287607d828de11d1770b2e2e0268d03d854270ac757f
SHA512

980ef35db889ab13d5f974e346c26353792b3063f30aa96565b940535513e11a2959868077b3e173d7be728c6eba28f4ff45ac3ef2554a055fffec8f84e79f5c
SSDEEP

6144:K/mNre9FyhhEDuS7uD9xNWiMuG4S9bCJzlT4A83PK0hTLgDJh80ip:KZZezk9bCnOPK0hT0DYRp

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
static1/unpack001/lame_enc.dll	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/lame_enc.dll	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/lame_enc.dll
unpack001/mp3enc.exe

Files

383970aeee89904841849906839ef7e4_JaffaCakes118
.zip
file_id.diz
lame_enc.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

beCloseStream
beDeinitStream
beEncodeChunk
beEncodeChunkFloatS16NI
beFlushNoGap
beInitStream
beVersion
beWriteInfoTag
beWriteVBRHeader
id3tag_init
id3tag_set_album
id3tag_set_artist
id3tag_set_comment
id3tag_set_title
id3tag_set_track
id3tag_set_year
lame_close
lame_encode_buffer_interleaved
lame_encode_flush
lame_get_in_samplerate
lame_get_num_channels
lame_get_num_samples
lame_get_out_samplerate
lame_get_scale
lame_get_scale_left
lame_get_scale_right
lame_init
lame_init_params
lame_mp3_tags_fid
lame_set_brate
lame_set_in_samplerate
lame_set_num_channels
lame_set_num_samples
lame_set_out_samplerate
lame_set_scale
lame_set_scale_left
lame_set_scale_right

Sections

UPX0
Size: - Virtual size: 320KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 90KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
mp3enc.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

.code
Size: - Virtual size: 316KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 175KB - Virtual size: 176KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

Headers

File Characteristics

Exports

Exports

Sections

UPX0 Size: - Virtual size: 320KB

UPX1 Size: 90KB - Virtual size: 92KB

UPX2 Size: 6KB - Virtual size: 8KB

Headers

File Characteristics

Sections

.code Size: - Virtual size: 316KB

.text Size: 175KB - Virtual size: 176KB

.rsrc Size: 4KB - Virtual size: 4KB

UPX0
Size: - Virtual size: 320KB

UPX1
Size: 90KB - Virtual size: 92KB

UPX2
Size: 6KB - Virtual size: 8KB

.code
Size: - Virtual size: 316KB

.text
Size: 175KB - Virtual size: 176KB

.rsrc
Size: 4KB - Virtual size: 4KB