bf27f2704c0e5aa08e1fa6427f474d77_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

bf27f2704c0e5aa08e1fa6427f474d77_JaffaCakes118
Size

66KB
MD5

bf27f2704c0e5aa08e1fa6427f474d77
SHA1

88721060bcef321df984d8413a78607b7c4128af
SHA256

acaf91e16cc34c7db6ddceb5c98e93eff389e0dafa3b8623c9067679ea0ef178
SHA512

8d8b369cbb4b8779de4f7a6305508d266c7306a29089991800a69a9f0fc1738921541134e20ec2ea836b6dcd9c5eb5df548aa0fa90e712a69dc6097899ac6c90
SSDEEP

1536:IpNGnAMFdMByqjeu39KCPKAY/1zeOnUnA6IVLnouy8TBSIrioQ+MhVQ:MNCzFd/dCyvbUA6IRoutTBSIrKhVQ

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

bf27f2704c0e5aa08e1fa6427f474d77_JaffaCakes118
.exe windows:5 windows x86 arch:x86

Code Sign

19:c7:9e:da:d6:7d:db:84:1f:10:31:18:86:03:3e:14
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

03/01/2020, 00:00

Not After

01/02/2022, 23:59

Subject

CN=INCON Co.\, Ltd.,O=INCON Co.\, Ltd.,L=Anyang-si,ST=Gyeonggi-do,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

23/10/2020, 00:00

Not After

22/01/2032, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

93:73:b7:df:45:61:d9:33:04:bc:a7:51:76:df:5f:59:d4:7d:c7:3d:85:a8:2f:aa:ea:25:53:35:e8:2f:dd:be
Signer

Actual PE Digest

93:73:b7:df:45:61:d9:33:04:bc:a7:51:76:df:5f:59:d4:7d:c7:3d:85:a8:2f:aa:ea:25:53:35:e8:2f:dd:be

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

UPX0
Size: - Virtual size: 148KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

Code Sign

19:c7:9e:da:d6:7d:db:84:1f:10:31:18:86:03:3e:14Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6bCertificate

Extended Key Usages

Key Usages

93:73:b7:df:45:61:d9:33:04:bc:a7:51:76:df:5f:59:d4:7d:c7:3d:85:a8:2f:aa:ea:25:53:35:e8:2f:dd:beSigner

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 148KB

UPX1 Size: 56KB - Virtual size: 56KB

.rsrc Size: 2KB - Virtual size: 4KB

19:c7:9e:da:d6:7d:db:84:1f:10:31:18:86:03:3e:14
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

93:73:b7:df:45:61:d9:33:04:bc:a7:51:76:df:5f:59:d4:7d:c7:3d:85:a8:2f:aa:ea:25:53:35:e8:2f:dd:be
Signer

UPX0
Size: - Virtual size: 148KB

UPX1
Size: 56KB - Virtual size: 56KB

.rsrc
Size: 2KB - Virtual size: 4KB