JaffaCakes118_4323cdd36641f9619f42d84a702a1237

General

Target
JaffaCakes118_4323cdd36641f9619f42d84a702a1237
Size 26KB
Sample250127-yle7nstkcw
SHA256 c1b4c502976592f8b26aeea3ff0e668387f199cde04f4e29fb8f01d1b8f3d39e
MD5 4323cdd36641f9619f42d84a702a1237
SHA1 73ef5cc722211ac22ff09f6709f14a25d14c64ec
SHA512 fb7409acc3377a80a0294ac648a0ef34d42a4fdd9e227c7de36a68d51029277446c809b68162ab0c5db36ec0146ddcaa047935cec0f01f04c8e0a00b5fbbf42e
SSDEEP 384:AfRlRmueB7tjg3wpjuwa1XSpdtNEXO3nkeWz0mOhYALhhEnoL9c9C:mHeB7ttjuwa1XMwe3keWz0JhYFnoLm9C
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/out.upx

File Explorer

JaffaCakes118_4323cdd36641f9619f42d84a702a1237

.exe 26KB
out.upx

.exe 32KB

JaffaCakes118_4323cdd36641f9619f42d84a702a1237

SHA256 c1b4c502976592f8b26aeea3ff0e668387f199cde04f4e29fb8f01d1b8f3d39e
MD5 4323cdd36641f9619f42d84a702a1237
SHA1 73ef5cc722211ac22ff09f6709f14a25d14c64ec
SHA512 fb7409acc3377a80a0294ac648a0ef34d42a4fdd9e227c7de36a68d51029277446c809b68162ab0c5db36ec0146ddcaa047935cec0f01f04c8e0a00b5fbbf42e
SSDEEP 384:AfRlRmueB7tjg3wpjuwa1XSpdtNEXO3nkeWz0mOhYALhhEnoL9c9C:mHeB7ttjuwa1XMwe3keWz0JhYFnoLm9C
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

PE Signature issue

Digest

0b:60:36:b6:6e:20:6f:e4:e6:32:f4:07:78:63:5a:da:f8:ad:8d:90

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Browser Plugin,OU=Website Viewer,O=Browser Plugin,L=Boston,ST=Lincolnshire,C=UK

Chains

Jan 24, 2025

Subject

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Serial Number

01

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Timespan

Aug 1, 1996 - Dec 31, 2020

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Serial Number

0a

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Aug 6, 2003 - Aug 5, 2013

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=Browser Plugin,OU=Website Viewer,O=Browser Plugin,L=Boston,ST=Lincolnshire,C=UK

Serial Number

3e:d5:70

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning

Timespan

Dec 8, 2004 - Nov 26, 2006

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Serial Number

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2008

Minor OS version

0

Major OS version

4

Entry point

48432

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

out.upx

SHA256 dbfa1f11479ec7e38fe791a06697234025263b7d45777e0844616455c9ae15ad
MD5 f0f0117f289892ba59f08a6042be3001
SHA1 43505bc3133f8fd2502ae34a32b0c01ae225bec3
SHA512 0b4f5210a7af54ab4f3265a0a9be53ebc15f0e4c8e9a49d6e965cd8b64e94f7c32b064212cd18aeab5fe3d1afbf1972dbfe2b60c16674276b01d66ec2022dd72
SSDEEP 768:qkckTEwaZ/McDmdZ5x9WKYh7WhT5TeQ0MhXtHBH:Ek3a5MW+T5NV
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

20040

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

JaffaCakes118_4323cdd36641f9619f42d84a702a1237

PE Signature issue

generic

out.upx

generic

Sharing

General

Malware Config

Signatures

File Explorer

JaffaCakes118_4323cdd36641f9619f42d84a702a1237

PE Signature issue

generic

out.upx

generic