fe8bcce26b67a1c029541db1a4e0e3f0_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

fe8bcce26b67a1c029541db1a4e0e3f0_JaffaCakes118
Size

3.3MB
MD5

fe8bcce26b67a1c029541db1a4e0e3f0
SHA1

bea73244c284da986087bb43c7597621370d5159
SHA256

fafe326dc4a426d717b0e72ce71419381aca44e8c321f7d63da2982818086e54
SHA512

cc3f87d30342eb8c4a08a4393ad64b5aa921f08e489ef12749b8a5167ad8195b3ae5bc49a8f9fdbb75dc962b9540355278b6bb075c3165fb4ab5e2a7dec2fd27
SSDEEP

98304:Aqz9Nhyd+HGxd4b9982x4hzUPMWWK4rLg:AqhS2Db9zK/Lg

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

fe8bcce26b67a1c029541db1a4e0e3f0_JaffaCakes118
.exe windows:5 windows x86 arch:x86

Code Sign

0a:a0:38:8c:35:b7:67:62:bb:72:60:af:e2:d2:31:18
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

04/02/2016, 00:00

Not After

27/09/2017, 23:59

Subject

CN=Sutherland Global Services\, Inc.,O=Sutherland Global Services\, Inc.,L=Rochester,ST=New York,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

0a:a0:38:8c:35:b7:67:62:bb:72:60:af:e2:d2:31:18
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

04/02/2016, 00:00

Not After

27/09/2017, 23:59

Subject

CN=Sutherland Global Services\, Inc.,O=Sutherland Global Services\, Inc.,L=Rochester,ST=New York,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:06:f1:0f:ce:68:f0:9b:fa:e5:5b:18:cd:8f:20:01:77
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for Advanced - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02/08/2011, 10:00

Not After

29/03/2029, 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

29:ba:a2:8e:3f:13:b7:d0:18:3c:58:c1:d3:42:80:c8:83:28:9d:78:a7:2b:8a:e6:eb:e0:de:1f:35:7d:41:ca
Signer

Actual PE Digest

29:ba:a2:8e:3f:13:b7:d0:18:3c:58:c1:d3:42:80:c8:83:28:9d:78:a7:2b:8a:e6:eb:e0:de:1f:35:7d:41:ca

Digest Algorithm

sha256

PE Digest Matches

true

e7:72:7f:8e:f8:df:08:67:03:2f:b9:8c:c3:ba:56:43:33:1c:33:96
Signer

Actual PE Digest

e7:72:7f:8e:f8:df:08:67:03:2f:b9:8c:c3:ba:56:43:33:1c:33:96

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

UPX0
Size: - Virtual size: 10.7MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 3.2MB - Virtual size: 3.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 23KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

Code Sign

0a:a0:38:8c:35:b7:67:62:bb:72:60:af:e2:d2:31:18Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0bCertificate

Extended Key Usages

Key Usages

0a:a0:38:8c:35:b7:67:62:bb:72:60:af:e2:d2:31:18Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

11:21:06:f1:0f:ce:68:f0:9b:fa:e5:5b:18:cd:8f:20:01:77Certificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:31:89:c6:50:04Certificate

Key Usages

29:ba:a2:8e:3f:13:b7:d0:18:3c:58:c1:d3:42:80:c8:83:28:9d:78:a7:2b:8a:e6:eb:e0:de:1f:35:7d:41:caSigner

e7:72:7f:8e:f8:df:08:67:03:2f:b9:8c:c3:ba:56:43:33:1c:33:96Signer

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 10.7MB

UPX1 Size: 3.2MB - Virtual size: 3.2MB

.rsrc Size: 23KB - Virtual size: 24KB

0a:a0:38:8c:35:b7:67:62:bb:72:60:af:e2:d2:31:18
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

0a:a0:38:8c:35:b7:67:62:bb:72:60:af:e2:d2:31:18
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

11:21:06:f1:0f:ce:68:f0:9b:fa:e5:5b:18:cd:8f:20:01:77
Certificate

04:00:00:00:00:01:31:89:c6:50:04
Certificate

29:ba:a2:8e:3f:13:b7:d0:18:3c:58:c1:d3:42:80:c8:83:28:9d:78:a7:2b:8a:e6:eb:e0:de:1f:35:7d:41:ca
Signer

e7:72:7f:8e:f8:df:08:67:03:2f:b9:8c:c3:ba:56:43:33:1c:33:96
Signer

UPX0
Size: - Virtual size: 10.7MB

UPX1
Size: 3.2MB - Virtual size: 3.2MB

.rsrc
Size: 23KB - Virtual size: 24KB