ea055949b07f348bbabe4312f7110fe5_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

ea055949b07f348bbabe4312f7110fe5_JaffaCakes118
Size

1.3MB
MD5

ea055949b07f348bbabe4312f7110fe5
SHA1

498851daa3c84aecd37f0ac8101cc9bb2fccb745
SHA256

7798bac8a39de2ae777d74a8d1dedf0208e93807ee6687a3a5f65a0db486d256
SHA512

2a3b3888cd6aba7ef946afd2f293ddf43bd60f274517585869d2851484f2a2b5ccbe337f1f668f3fded85e7d16f42cf02721cc9f9d5b40c2f2120fbe8a8ac060
SSDEEP

24576:At5xW35gzF3V0KQSdbBWdnn5voeU5iMk6P/kDUv457EvZaqckQvjJOqGTDulf0be:A4pgzF3uKBBWdnnxx6ZkDGvZUkQvjQqp

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/out.upx

Files

ea055949b07f348bbabe4312f7110fe5_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Code Sign

04:00:00:00:00:01:20:19:c1:90:66
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

18-03-2009 11:00

Not After

28-01-2028 12:00

Subject

CN=GlobalSign Timestamping CA,OU=Timestamping CA,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13-04-2011 10:00

Not After

13-04-2019 10:00

Subject

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

01:00:00:00:00:01:25:b0:b4:cc:01
Certificate

Issuer

CN=GlobalSign Timestamping CA,OU=Timestamping CA,O=GlobalSign

Not Before

21-12-2009 09:32

Not After

22-12-2020 09:32

Subject

CN=GlobalSign Time Stamping Authority,O=GlobalSign NV,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

11:21:47:6b:54:73:07:01:22:1e:6b:e1:28:2a:07:b2:82:cb
Certificate

Issuer

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

07-03-2012 21:09

Not After

08-03-2015 21:09

Subject

CN=Newsoftwares.net\, Inc SDN BHD,O=Newsoftwares.net\, Inc SDN BHD,L=Kuala Lumpur,ST=Kuala Lumpur,C=MY

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

96:c7:b3:6f:4a:36:5e:e0:ee:3a:98:2a:6a:ac:ab:15:06:f5:2b:15
Signer

Actual PE Digest

96:c7:b3:6f:4a:36:5e:e0:ee:3a:98:2a:6a:ac:ab:15:06:f5:2b:15

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 4.4MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 39KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 284KB - Virtual size: 283KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 76KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5.2MB - Virtual size: 5.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

04:00:00:00:00:01:20:19:c1:90:66Certificate

Key Usages

04:00:00:00:00:01:2f:4e:e1:35:5cCertificate

Extended Key Usages

Key Usages

01:00:00:00:00:01:25:b0:b4:cc:01Certificate

Extended Key Usages

Key Usages

11:21:47:6b:54:73:07:01:22:1e:6b:e1:28:2a:07:b2:82:cbCertificate

Extended Key Usages

Key Usages

96:c7:b3:6f:4a:36:5e:e0:ee:3a:98:2a:6a:ac:ab:15:06:f5:2b:15Signer

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 4.4MB

UPX1 Size: 1.2MB - Virtual size: 1.2MB

.rsrc Size: 39KB - Virtual size: 40KB

Headers

File Characteristics

Sections

.text Size: 284KB - Virtual size: 283KB

.rdata Size: 76KB - Virtual size: 72KB

.data Size: 12KB - Virtual size: 27KB

.rsrc Size: 5.2MB - Virtual size: 5.2MB

04:00:00:00:00:01:20:19:c1:90:66
Certificate

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

01:00:00:00:00:01:25:b0:b4:cc:01
Certificate

11:21:47:6b:54:73:07:01:22:1e:6b:e1:28:2a:07:b2:82:cb
Certificate

96:c7:b3:6f:4a:36:5e:e0:ee:3a:98:2a:6a:ac:ab:15:06:f5:2b:15
Signer

UPX0
Size: - Virtual size: 4.4MB

UPX1
Size: 1.2MB - Virtual size: 1.2MB

.rsrc
Size: 39KB - Virtual size: 40KB

.text
Size: 284KB - Virtual size: 283KB

.rdata
Size: 76KB - Virtual size: 72KB

.data
Size: 12KB - Virtual size: 27KB

.rsrc
Size: 5.2MB - Virtual size: 5.2MB