5471e5ca0cb4ebbdddddffa1c91de400_JaffaCakes118

General

Target
5471e5ca0cb4ebbdddddffa1c91de400_JaffaCakes118
Size 624KB
Sample241018-an7spsvemc
SHA256 7c2a2ea3818e7ac508db4178935295ac8c3b6fff9fdf417f97328083ed593af0
MD5 5471e5ca0cb4ebbdddddffa1c91de400
SHA1 8317c092e0ced69ac2cd74506771036b3165f028
SHA512 1f48ae9502cf671ff44de45a9340997f2aae22b025280df9a8f6522563b559b126eb75d5f1eb4929c7ca708614b2676c9e2ccdeefafb60be4a91e8797ddb187c
SSDEEP 12288:IXdHGcMBTzqt1X5ZY0cnLvo+roqnSjKVm71FprwlCVjdz:ERMBa7YZQW1ERFprwCVxz
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/out.upx

File Explorer

5471e5ca0cb4ebbdddddffa1c91de400_JaffaCakes118

.exe 624KB
out.upx

.exe 1.6MB

5471e5ca0cb4ebbdddddffa1c91de400_JaffaCakes118

SHA256 7c2a2ea3818e7ac508db4178935295ac8c3b6fff9fdf417f97328083ed593af0
MD5 5471e5ca0cb4ebbdddddffa1c91de400
SHA1 8317c092e0ced69ac2cd74506771036b3165f028
SHA512 1f48ae9502cf671ff44de45a9340997f2aae22b025280df9a8f6522563b559b126eb75d5f1eb4929c7ca708614b2676c9e2ccdeefafb60be4a91e8797ddb187c
SSDEEP 12288:IXdHGcMBTzqt1X5ZY0cnLvo+roqnSjKVm71FprwlCVjdz:ERMBa7YZQW1ERFprwCVxz
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

PE Signature issue

Digest

61:93:78:7a:67:bb:9b:4f:8a:ba:50:a0:cb:8c:c1:23:b6:92:3f:ab

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=REALTIME GAMING,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=REALTIME GAMING,L=Sandy Springs,ST=Georgia,C=US

Chains

Oct 14, 2024

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Serial Number

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Timespan

Jan 29, 1996 - Aug 1, 2028

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=REALTIME GAMING,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=REALTIME GAMING,L=Sandy Springs,ST=Georgia,C=US

Serial Number

4c:1b:73:6b:c6:71:4c:7d:a3:b1:d3:3e:ad:b3:3a:2b

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 20, 2006 - Oct 21, 2009

Minor OS version

0

Major OS version

4

Entry point

1694944

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

out.upx

SHA256 02570fc4308658585ede812a422528aa8af761c3a4d1eaf149b187f3d2b9ee8b
MD5 d5a8922b2db534c8a9b47f85453e30c4
SHA1 6e12b389a57851c7f710ed6d8901a56f1c13a979
SHA512 ebfacddb70e69f45ae183504c9a84a0cef046e4597129acf8fc5e1f710b346871b91e3a2bb831c934c7ccae286e3a041f723eab5cfc30d5a9c27ce7540bf2351
SSDEEP 12288:wv60GKHC2FVMBiu2z9pGsjrMuFbVwgSQgB1tB57jKVm71FprwlCVjd:z9KY72z9p1jrMuFbSQqtB5vRFprwCVx
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

349708

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

5471e5ca0cb4ebbdddddffa1c91de400_JaffaCakes118

PE Signature issue

generic

out.upx

generic

Sharing

General

Malware Config

Signatures

File Explorer

5471e5ca0cb4ebbdddddffa1c91de400_JaffaCakes118

PE Signature issue

generic

out.upx

generic