4261cffac9008c632a27ac0d6404d998_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
4261cffac9008c632a27ac0d6404d998_JaffaCakes118
Size 211KB
Sample240713-tha2bszbpe
SHA256 be0c718fba2176ffbe9a8dd49459f93b70e10be19ae15b61e57374cfd9088527
MD5 4261cffac9008c632a27ac0d6404d998
SHA1 51cf108d24bb9737272a864d4f21ebd5a347e37e
SHA512 9b2b95bf7ed276e04916246f4ff56cde376ac91246a869f4fcc17f7eb7c0bf884c998a1f795e74162ffcc2328f560209c62954f2da074d7579c0015f4f9663ca
SSDEEP 6144:zs1XbJLF2tMe8Bvp2hdjE71O+ZjUzhNj:zgbJLFYMe++NE716h
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
sample	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/out.upx

File Explorer

4261cffac9008c632a27ac0d6404d998_JaffaCakes118

.dll 211KB
out.upx

.dll 506KB

4261cffac9008c632a27ac0d6404d998_JaffaCakes118

SHA256 be0c718fba2176ffbe9a8dd49459f93b70e10be19ae15b61e57374cfd9088527
MD5 4261cffac9008c632a27ac0d6404d998
SHA1 51cf108d24bb9737272a864d4f21ebd5a347e37e
SHA512 9b2b95bf7ed276e04916246f4ff56cde376ac91246a869f4fcc17f7eb7c0bf884c998a1f795e74162ffcc2328f560209c62954f2da074d7579c0015f4f9663ca
SSDEEP 6144:zs1XbJLF2tMe8Bvp2hdjE71O+ZjUzhNj:zgbJLFYMe++NE716h
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

PE Signature issue

Digest

3d:1b:2f:b8:5c:49:e3:b1:b7:f7:e7:15:c4:0d:9b:10:77:c8:42:04

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=HOW SOFT,O=HOW SOFT,L=Guro-gu,ST=SEOUL,C=KR

Chains

Dec 14, 2011

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=HOW SOFT,O=HOW SOFT,L=Guro-gu,ST=SEOUL,C=KR

Serial Number

3b:98:17:fb:e1:54:b0:34:66:89:e1:85:2f:97:04:a7

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning

Timespan

Dec 16, 2010 - Dec 16, 2011

Subject

Serial Number

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 17, 2006 - Jul 16, 2036

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Serial Number

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

675248

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

out.upx

SHA256 f47188226453de3d1d9bffc87a0ad5bdcfa3631faf7121a81fa25f0f8b9ed139
MD5 31b7ab50eeb8bcd432ef06474f77ae20
SHA1 b49faf1df5e3b14a1c7787875d032afd3acea286
SHA512 7424bb99fae2ce0fffc5599789e6fc98abf3e5c410a5bb8661f7ca5d37cd063fa9faa869e4921ded3efecf20b2f751150815e0964e292c410e43c48ec5ca2de3
SSDEEP 6144:iXuq92173UgCEYtwmln+F7rhSo/Q6eULRrZWOzdB+txPLj1TvWajwuApoyrYLgDx:i817kA0wmlnoJJ5zCVxjVApBYLcVk
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

452640

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

.text

Size

435KB

Virtual Size

434KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

106KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

68B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

28KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

4261cffac9008c632a27ac0d6404d998_JaffaCakes118

PE Signature issue

generic

out.upx

generic