c0f28601a6cafe37425de5b1f2e4232c_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

c0f28601a6cafe37425de5b1f2e4232c_JaffaCakes118
Size

114KB
MD5

c0f28601a6cafe37425de5b1f2e4232c
SHA1

62bac69c9baf1d7f720baaec046ac97411d02b4b
SHA256

9502a906a29f68427cb67566d566696d1a506d98f3dbb86a738c625466cb4934
SHA512

892c69886176cb30ac45256e2fef5d2b40178003491444d47b7c4af8674507f75a472725a16c92b6a493d561ad9c0c75bc935323763bc8929e7a251d2eaffdbf
SSDEEP

3072:ToKjExoCwUtnlPAenGhiJuCfO+FDAly2hw1fxc95y:sKjDctlPGFC7bVGc

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

c0f28601a6cafe37425de5b1f2e4232c_JaffaCakes118
.dll windows:4 windows x86 arch:x86

05c7df6d575c13faf78878f9450f3b20

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:06:94:2d:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:02

Not After

25/07/2013, 19:12

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

0f:d6:af:9e:02:b3:ad:50:af:31:61:bc:16:eb:fe:fd:15:18:3a:d2
Signer

Actual PE Digest

0f:d6:af:9e:02:b3:ad:50:af:31:61:bc:16:eb:fe:fd:15:18:3a:d2

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetProcAddress
ExitProcess

Sections

UPX0
Size: - Virtual size: 67KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Shared
Size: 4KB - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX4
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX5
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX6
Size: 92KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX7
Size: 970B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 256B - Virtual size:

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

05c7df6d575c13faf78878f9450f3b20

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0Certificate

Extended Key Usages

Key Usages

61:01:cf:3e:00:00:00:00:00:0fCertificate

Extended Key Usages

Key Usages

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2Certificate

Extended Key Usages

Key Usages

61:06:94:2d:00:00:00:00:00:09Certificate

Extended Key Usages

Key Usages

0f:d6:af:9e:02:b3:ad:50:af:31:61:bc:16:eb:fe:fd:15:18:3a:d2Signer

Headers

File Characteristics

Imports

kernel32

Sections

UPX0 Size: - Virtual size: 67KB

UPX1 Size: - Virtual size: 5KB

UPX2 Size: - Virtual size: 20KB

Shared Size: 4KB - Virtual size: 16B

UPX4 Size: - Virtual size: 1KB

UPX5 Size: - Virtual size: 4KB

UPX6 Size: 92KB - Virtual size: 96KB

UPX7 Size: 970B - Virtual size: 4KB

Size: 256B - Virtual size:

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

61:01:cf:3e:00:00:00:00:00:0f
Certificate

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

61:06:94:2d:00:00:00:00:00:09
Certificate

0f:d6:af:9e:02:b3:ad:50:af:31:61:bc:16:eb:fe:fd:15:18:3a:d2
Signer

UPX0
Size: - Virtual size: 67KB

UPX1
Size: - Virtual size: 5KB

UPX2
Size: - Virtual size: 20KB

Shared
Size: 4KB - Virtual size: 16B

UPX4
Size: - Virtual size: 1KB

UPX5
Size: - Virtual size: 4KB

UPX6
Size: 92KB - Virtual size: 96KB

UPX7
Size: 970B - Virtual size: 4KB