c1684f6a3fa68f7059b74a6ab28be6a7_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

c1684f6a3fa68f7059b74a6ab28be6a7_JaffaCakes118
Size

1.1MB
MD5

c1684f6a3fa68f7059b74a6ab28be6a7
SHA1

66a8a9fb1ffa35240ead4e8a12c97aca904681ec
SHA256

8c6161ad7adb49def3c9fc2d6d6435ca02e29c1d604a9bc4142330b45c6b1479
SHA512

fe1ce4af2c6a95f86b287ff7d294a491d5afd9a9ba75051ba27aef61f396ba13173ce8e01da66ad554c13580cd9b2b6fba46c400bb3735f67792869cb63cc45c
SSDEEP

24576:tMXIsY72Fc+kBtyvDrgGmQHkEhHQYjWFxx8XXo1r8vRqD+PjdYOrH+GKE:tp+oFQHk2jWFrSY14oD+LdYOreGP

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
sample	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/out.upx

Files

c1684f6a3fa68f7059b74a6ab28be6a7_JaffaCakes118
.dll regsvr32 windows:5 windows x86 arch:x86

Code Sign

16:78:5f:91:41:e6:65:06:47:59:b1:01:32:27:bb:2b
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02/02/2016, 00:00

Not After

03/05/2019, 23:59

Subject

CN=Aculearn Pte Ltd,O=Aculearn Pte Ltd,L=Singapore,ST=Singapore,C=SG

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02/01/2017, 00:00

Not After

01/04/2028, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

08:ae:95:1b:8c:17:c3:8e:20:39:6a:d7:91:33:d4:fc:b3:e9:76:28:9b:41:7e:9c:f9:6a:ab:4d:2d:e3:d3:fe
Signer

Actual PE Digest

08:ae:95:1b:8c:17:c3:8e:20:39:6a:d7:91:33:d4:fc:b3:e9:76:28:9b:41:7e:9c:f9:6a:ab:4d:2d:e3:d3:fe

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
curl_easy_cleanup
curl_easy_duphandle
curl_easy_escape
curl_easy_getinfo
curl_easy_init
curl_easy_pause
curl_easy_perform
curl_easy_recv
curl_easy_reset
curl_easy_send
curl_easy_setopt
curl_easy_strerror
curl_easy_unescape
curl_escape
curl_formadd
curl_formfree
curl_formget
curl_free
curl_getdate
curl_getenv
curl_global_cleanup
curl_global_init
curl_global_init_mem
curl_maprintf
curl_mfprintf
curl_mprintf
curl_msnprintf
curl_msprintf
curl_multi_add_handle
curl_multi_assign
curl_multi_cleanup
curl_multi_fdset
curl_multi_info_read
curl_multi_init
curl_multi_perform
curl_multi_remove_handle
curl_multi_setopt
curl_multi_socket
curl_multi_socket_action
curl_multi_socket_all
curl_multi_strerror
curl_multi_timeout
curl_mvaprintf
curl_mvfprintf
curl_mvprintf
curl_mvsnprintf
curl_mvsprintf
curl_share_cleanup
curl_share_init
curl_share_setopt
curl_share_strerror
curl_slist_append
curl_slist_free_all
curl_strequal
curl_strnequal
curl_unescape

Sections

UPX0
Size: - Virtual size: 1.8MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.dll windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 491KB - Virtual size: 491KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 72KB - Virtual size: 97KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

SEG_HTTP
Size: 512B - Virtual size: 1B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 135KB - Virtual size: 134KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

16:78:5f:91:41:e6:65:06:47:59:b1:01:32:27:bb:2bCertificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6Certificate

Extended Key Usages

Key Usages

08:ae:95:1b:8c:17:c3:8e:20:39:6a:d7:91:33:d4:fc:b3:e9:76:28:9b:41:7e:9c:f9:6a:ab:4d:2d:e3:d3:feSigner

Headers

DLL Characteristics

File Characteristics

Exports

Exports

Sections

UPX0 Size: - Virtual size: 1.8MB

UPX1 Size: 1.1MB - Virtual size: 1.1MB

.rsrc Size: 9KB - Virtual size: 12KB

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 2.1MB - Virtual size: 2.1MB

.rdata Size: 491KB - Virtual size: 491KB

.data Size: 72KB - Virtual size: 97KB

.tls Size: 512B - Virtual size: 2B

SEG_HTTP Size: 512B - Virtual size: 1B

.rsrc Size: 7KB - Virtual size: 6KB

.reloc Size: 135KB - Virtual size: 134KB

16:78:5f:91:41:e6:65:06:47:59:b1:01:32:27:bb:2b
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

08:ae:95:1b:8c:17:c3:8e:20:39:6a:d7:91:33:d4:fc:b3:e9:76:28:9b:41:7e:9c:f9:6a:ab:4d:2d:e3:d3:fe
Signer

UPX0
Size: - Virtual size: 1.8MB

UPX1
Size: 1.1MB - Virtual size: 1.1MB

.rsrc
Size: 9KB - Virtual size: 12KB

.text
Size: 2.1MB - Virtual size: 2.1MB

.rdata
Size: 491KB - Virtual size: 491KB

.data
Size: 72KB - Virtual size: 97KB

.tls
Size: 512B - Virtual size: 2B

SEG_HTTP
Size: 512B - Virtual size: 1B

.rsrc
Size: 7KB - Virtual size: 6KB

.reloc
Size: 135KB - Virtual size: 134KB