socelars | 1fed356c066f7de157aa216f54389460_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

1fed356c066f7de157aa216f54389460_JaffaCakes118
Size

545KB
MD5

1fed356c066f7de157aa216f54389460
SHA1

0869622e70083ad7bb45ba32b01268ebc9843413
SHA256

552fd68307040c32ff165409f9d602d927f7b182eabe6b93df97991b42c1b38b
SHA512

c7e76885b54992dcb29a14d4a533b14fef5a6c7101e9f9b3b0271606442e5b5dc2d38dfdb2a68e4e1ff982fb74069d47560f3d97aacf65ba9559914c053c3a72
SSDEEP

12288:ObrVyGLih+vAIeRIVAdVLCtlFN5OrGsBHdZWg:ObNKNIeOYLoxgH3Wg

Score

10^/10

upx socelars

Malware Config

Extracted

Family

socelars

http://www.sblinfo.pw/index.php/

Signatures

Socelars family
socelars

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
unpack001/out.upx

Files

1fed356c066f7de157aa216f54389460_JaffaCakes118
.exe windows:6 windows x86 arch:x86

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13-04-2011 10:00

Not After

28-01-2028 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:c3:0f:fe:fc:22:bb:28:0f:96:fe:a7:52:51
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

16-03-2016 00:00

Not After

16-03-2024 00:00

Subject

CN=GlobalSign CodeSigning CA - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24-05-2016 00:00

Not After

24-06-2027 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

1f:58:a7:32:1e:ec:61:7e:26:ce:32:30
Certificate

Issuer

CN=GlobalSign CodeSigning CA - G3,O=GlobalSign nv-sa,C=BE

Not Before

05-07-2018 06:20

Not After

09-01-2020 09:11

Subject

CN=NEUTRON GUVENLIK TEKNOLOJILERI ANONIM SIRKETI,O=NEUTRON GUVENLIK TEKNOLOJILERI ANONIM SIRKETI,L=KAGITHANE,ST=ISTANBUL,C=TR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

47:c3:0f:fe:fc:22:bb:28:0f:96:fe:a7:52:51
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

16-03-2016 00:00

Not After

16-03-2024 00:00

Subject

CN=GlobalSign CodeSigning CA - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1f:58:a7:32:1e:ec:61:7e:26:ce:32:30
Certificate

Issuer

CN=GlobalSign CodeSigning CA - G3,O=GlobalSign nv-sa,C=BE

Not Before

05-07-2018 06:20

Not After

09-01-2020 09:11

Subject

CN=NEUTRON GUVENLIK TEKNOLOJILERI ANONIM SIRKETI,O=NEUTRON GUVENLIK TEKNOLOJILERI ANONIM SIRKETI,L=KAGITHANE,ST=ISTANBUL,C=TR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

50:67:fa:46:ce:6c:fe:95:15:a6:9e:b2
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

14-06-2018 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign TSA for Advanced - G3 - 003-02,O=GMO GlobalSign K.K.,C=JP

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02-08-2011 10:00

Not After

29-03-2029 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18-03-2009 10:00

Not After

18-03-2029 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

58:be:80:49:11:f6:4e:95:b5:08:97:d0:f8:48:04:fd:ed:e3:37:99:db:ea:9e:20:28:07:cc:ac:ff:5a:bc:2c
Signer

Actual PE Digest

58:be:80:49:11:f6:4e:95:b5:08:97:d0:f8:48:04:fd:ed:e3:37:99:db:ea:9e:20:28:07:cc:ac:ff:5a:bc:2c

Digest Algorithm

sha256

PE Digest Matches

true

1d:7d:ec:69:89:67:54:43:cc:64:6d:b3:88:29:2a:88:85:a5:34:75
Signer

Actual PE Digest

1d:7d:ec:69:89:67:54:43:cc:64:6d:b3:88:29:2a:88:85:a5:34:75

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 660KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 451KB - Virtual size: 452KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 67KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 830KB - Virtual size: 830KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 137KB - Virtual size: 137KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 67KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7Certificate

Key Usages

47:c3:0f:fe:fc:22:bb:28:0f:96:fe:a7:52:51Certificate

Extended Key Usages

Key Usages

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14Certificate

Extended Key Usages

Key Usages

1f:58:a7:32:1e:ec:61:7e:26:ce:32:30Certificate

Extended Key Usages

Key Usages

47:c3:0f:fe:fc:22:bb:28:0f:96:fe:a7:52:51Certificate

Extended Key Usages

Key Usages

1f:58:a7:32:1e:ec:61:7e:26:ce:32:30Certificate

Extended Key Usages

Key Usages

50:67:fa:46:ce:6c:fe:95:15:a6:9e:b2Certificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:31:89:c6:50:04Certificate

Key Usages

04:00:00:00:00:01:21:58:53:08:a2Certificate

Key Usages

58:be:80:49:11:f6:4e:95:b5:08:97:d0:f8:48:04:fd:ed:e3:37:99:db:ea:9e:20:28:07:cc:ac:ff:5a:bc:2cSigner

1d:7d:ec:69:89:67:54:43:cc:64:6d:b3:88:29:2a:88:85:a5:34:75Signer

Headers

DLL Characteristics

File Characteristics

Sections

UPX0 Size: - Virtual size: 660KB

UPX1 Size: 451KB - Virtual size: 452KB

.rsrc Size: 67KB - Virtual size: 68KB

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 830KB - Virtual size: 830KB

.rdata Size: 137KB - Virtual size: 137KB

.data Size: 8KB - Virtual size: 16KB

.rsrc Size: 67KB - Virtual size: 66KB

.reloc Size: 26KB - Virtual size: 26KB

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

47:c3:0f:fe:fc:22:bb:28:0f:96:fe:a7:52:51
Certificate

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

1f:58:a7:32:1e:ec:61:7e:26:ce:32:30
Certificate

47:c3:0f:fe:fc:22:bb:28:0f:96:fe:a7:52:51
Certificate

1f:58:a7:32:1e:ec:61:7e:26:ce:32:30
Certificate

50:67:fa:46:ce:6c:fe:95:15:a6:9e:b2
Certificate

04:00:00:00:00:01:31:89:c6:50:04
Certificate

04:00:00:00:00:01:21:58:53:08:a2
Certificate

58:be:80:49:11:f6:4e:95:b5:08:97:d0:f8:48:04:fd:ed:e3:37:99:db:ea:9e:20:28:07:cc:ac:ff:5a:bc:2c
Signer

1d:7d:ec:69:89:67:54:43:cc:64:6d:b3:88:29:2a:88:85:a5:34:75
Signer

UPX0
Size: - Virtual size: 660KB

UPX1
Size: 451KB - Virtual size: 452KB

.rsrc
Size: 67KB - Virtual size: 68KB

.text
Size: 830KB - Virtual size: 830KB

.rdata
Size: 137KB - Virtual size: 137KB

.data
Size: 8KB - Virtual size: 16KB

.rsrc
Size: 67KB - Virtual size: 66KB

.reloc
Size: 26KB - Virtual size: 26KB