bff498d55652fd63138f7e40e2fdf646_JaffaCakes118

General

Target
bff498d55652fd63138f7e40e2fdf646_JaffaCakes118
Size 650KB
Sample240825-e6bv7svcpc
SHA256 1e076f94e4eb07c25b0b02483fe6007be86e8a793dc813560d5198003da8dcae
MD5 bff498d55652fd63138f7e40e2fdf646
SHA1 23c107fd3e22585a293e59543243fed59a324395
SHA512 97f0d8d94faf23d579d49f6070937db60fb314f2f53c1e4cf0ea7d952446260305910f243b6e06b8cd884c773616ce8211d49c9bf14e9b483f5e4e80d778433d
SSDEEP 12288:2o3KhmMOghEyEsWCCs9gI3K1ERaNUukCdLDzZBSoGFb78y60zr6cZ+wSX9PIXCc8:5fa1xWo2IKERAjkSfzZBSH7R+cZ+txIu
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack002/Maersk Bill of ladding final docs.exe	upx

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
static1/unpack003/out.upx	autoit_exe

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack002/Maersk Bill of ladding final docs.exe
unpack003/out.upx

File Explorer

bff498d55652fd63138f7e40e2fdf646_JaffaCakes118

.ace 650KB
out.ace

.ace 650KB
Maersk Bill of ladding final docs.exe

.exe 886KB
out.upx

.exe 1.3MB

bff498d55652fd63138f7e40e2fdf646_JaffaCakes118

SHA256 1e076f94e4eb07c25b0b02483fe6007be86e8a793dc813560d5198003da8dcae
MD5 bff498d55652fd63138f7e40e2fdf646
SHA1 23c107fd3e22585a293e59543243fed59a324395
SHA512 97f0d8d94faf23d579d49f6070937db60fb314f2f53c1e4cf0ea7d952446260305910f243b6e06b8cd884c773616ce8211d49c9bf14e9b483f5e4e80d778433d
SSDEEP 12288:2o3KhmMOghEyEsWCCs9gI3K1ERaNUukCdLDzZBSoGFb78y60zr6cZ+wSX9PIXCc8:5fa1xWo2IKERAjkSfzZBSH7R+cZ+txIu
MD5 SHA1 SHA512 SSDEEP

Maersk Bill of ladding final docs.exe

SHA256 592374e47050456f6402537fe300de6bd224a3a7b9ad1b4f9214ab298e075ce9
MD5 9b8bf5cb432ba0b3e6a64c2d2fdf843b
SHA1 8a9706887e232a1d62afcf73a8db3aff63cad6bd
SHA512 68b6fa1f6f54940802b6b9b5a4903d0cd9d47c5f39b373805f65b55d6f1fee8e66647f5cbbf7ddc088c60c2c53ccd711dad6bd30189129f2fbcc1e9c24ca3e53
SSDEEP 12288:cquEdbHF6xC9D6DmR1J98w4oknqOOCyQfhcwQ6doE6TvqqJ7QejochX0iucXrjRV:tdbl6kD68JmlotQfpMTl9r7jP
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

1430272

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

out.upx

SHA256 d72cc26f0de74101a94f911ca6d5f8d34b0eb327a64155cf068ef5f954f4d5fe
MD5 be7ec0f750107a7742d2d544573ea11d
SHA1 5cb14173784824fe7c0eed1dc45406488ea1e5a9
SHA512 1347f5b09ddcb7d0f37f1c4bb8eec91b9e5c276591349224d2ac4e5db2382dd0a3aca64d2def65da93f51ca455ae302b9768347f04f7e3b88a0b7a8473c4c269
SSDEEP 24576:Cu6Jx3O0c+JY5UZ+XC0kGsokVMTl9r7jP:kI0c++OCvkGsX
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

AutoIT Executable

AutoIT scripts compiled to PE executables.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

163277

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

bff498d55652fd63138f7e40e2fdf646_JaffaCakes118

out.ace

Maersk Bill of ladding final docs.exe

generic

out.upx

generic

Sharing

General

Malware Config

Signatures

File Explorer

bff498d55652fd63138f7e40e2fdf646_JaffaCakes118

out.ace

Maersk Bill of ladding final docs.exe

generic

out.upx

generic