45fe38f00c8900cd0c2d34a1246966fe_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

45fe38f00c8900cd0c2d34a1246966fe_JaffaCakes118
Size

470KB
MD5

45fe38f00c8900cd0c2d34a1246966fe
SHA1

aa0bbc7e4b5cb160633020b73c9c306be81e5dab
SHA256

f6b56b0457b9543bff8f1ef48ac016c43e15ca757bb331ccf7747e26b3c86745
SHA512

12e11c56edee64446c51d6b97881a643c7317bc5be78ce5f86450b9906eb906bef3a69249fd71f38237fe57a4759aec0e0743cf255c4801defa394ed23b29052
SSDEEP

12288:Lp26dlAX1TBu3Ym6zphgSBWY1zIwU6J8mExO2TqW/Va8Csfp:LpTA1TMAph1B3zIm8wB4aap

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/out.upx

Files

45fe38f00c8900cd0c2d34a1246966fe_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

17:ef:eb:dd:af:65:d6:03:c5:59:cf:37:02:27:a3:11
Certificate

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

10/02/2012, 00:00

Not After

09/02/2015, 23:59

Subject

CN=Chris Long,O=Chris Long,POSTALCODE=92835,STREET=2851 Rolling Hills Dr. SPC 117,L=Fullerton,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

dc:7c:90:8e:60:02:81:68:a3:93:1a:c9:f5:40:4b:6b:c9:0e:1e:b7
Signer

Actual PE Digest

dc:7c:90:8e:60:02:81:68:a3:93:1a:c9:f5:40:4b:6b:c9:0e:1e:b7

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 1.2MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 451KB - Virtual size: 452KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 14KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 808KB - Virtual size: 806KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 844KB - Virtual size: 840KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:beCertificate

Extended Key Usages

Key Usages

17:ef:eb:dd:af:65:d6:03:c5:59:cf:37:02:27:a3:11Certificate

Extended Key Usages

Key Usages

dc:7c:90:8e:60:02:81:68:a3:93:1a:c9:f5:40:4b:6b:c9:0e:1e:b7Signer

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 1.2MB

UPX1 Size: 451KB - Virtual size: 452KB

.rsrc Size: 14KB - Virtual size: 16KB

Headers

File Characteristics

Sections

.text Size: 808KB - Virtual size: 806KB

.data Size: - Virtual size: 43KB

.rsrc Size: 844KB - Virtual size: 840KB

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

17:ef:eb:dd:af:65:d6:03:c5:59:cf:37:02:27:a3:11
Certificate

dc:7c:90:8e:60:02:81:68:a3:93:1a:c9:f5:40:4b:6b:c9:0e:1e:b7
Signer

UPX0
Size: - Virtual size: 1.2MB

UPX1
Size: 451KB - Virtual size: 452KB

.rsrc
Size: 14KB - Virtual size: 16KB

.text
Size: 808KB - Virtual size: 806KB

.data
Size: - Virtual size: 43KB

.rsrc
Size: 844KB - Virtual size: 840KB