numando | JaffaCakes118_1ce590d9a12eb8af33f17ed9b5e2df3f

Sharing

Copy URL Twitter E-mail

General

Target
JaffaCakes118_1ce590d9a12eb8af33f17ed9b5e2df3f
Size 7.1MB
Sample250705-evesqasxgz
SHA256 5d8824b573741be1ce36f973a06230b5a77c25e5488219526c475ff43d646cfb
MD5 1ce590d9a12eb8af33f17ed9b5e2df3f
SHA1 607cf034217c87677794d31dee7db299619a4adf
SHA512 3d4ab8c014e2ad92f6988fbbc65ffd2716f507b908432545d9c0a19c044b9fca5dcf01569fb9d736777f04a2b862e21e58979457b2321ed0a93139bc68a3503d
SSDEEP 196608:I3iBy1JaBVJg8j+eMnv/XATvGun0/6ShhRfZMLbolj5k3JCmPwY3wIsY3RuBaqlo:IyB+Mwgbx0/6SNNbmJCmPt74ae
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

upx numando

Malware Config

Signatures

Detect Numando payload 1 IoCs

resource	yara_rule
static1/unpack001/out.upx	family_numando

Numando family
numando

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
sample	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_1ce590d9a12eb8af33f17ed9b5e2df3f
unpack001/out.upx

File Explorer

JaffaCakes118_1ce590d9a12eb8af33f17ed9b5e2df3f

.dll 7.1MB
out.upx

.dll 9.0MB

JaffaCakes118_1ce590d9a12eb8af33f17ed9b5e2df3f

SHA256 5d8824b573741be1ce36f973a06230b5a77c25e5488219526c475ff43d646cfb
MD5 1ce590d9a12eb8af33f17ed9b5e2df3f
SHA1 607cf034217c87677794d31dee7db299619a4adf
SHA512 3d4ab8c014e2ad92f6988fbbc65ffd2716f507b908432545d9c0a19c044b9fca5dcf01569fb9d736777f04a2b862e21e58979457b2321ed0a93139bc68a3503d
SSDEEP 196608:I3iBy1JaBVJg8j+eMnv/XATvGun0/6ShhRfZMLbolj5k3JCmPwY3wIsY3RuBaqlo:IyB+Mwgbx0/6SNNbmJCmPt74ae
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10204976

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

DoBroadcastSystemMessage DoCommandLinePrompt DoPasswordDialog DoProfileErrorDialog I_MprSaveConn MultinetGetConnectionPerformanceA MultinetGetConnectionPerformanceW MultinetGetErrorTextA MultinetGetErrorTextW ShowReconnectDialog ShowReconnectDialogEnd ShowReconnectDialogUI TMethodImplementationIntercept WNetAddConnection2A WNetAddConnection2W WNetAddConnection3A WNetAddConnection3W WNetAddConnectionA WNetAddConnectionW WNetCancelConnection2A WNetCancelConnection2W WNetCancelConnectionA WNetCancelConnectionW WNetClearConnections WNetCloseEnum WNetConnectionDialog WNetConnectionDialog1A WNetConnectionDialog1W WNetConnectionDialog2 WNetDirectoryNotifyA WNetDirectoryNotifyW WNetDisconnectDialog WNetDisconnectDialog1A WNetDisconnectDialog1W WNetDisconnectDialog2 WNetEnumResourceA WNetEnumResourceW WNetFormatNetworkNameA WNetFormatNetworkNameW WNetGetConnection2A WNetGetConnection2W WNetGetConnection3A WNetGetConnection3W WNetGetConnectionA WNetGetConnectionW WNetGetDirectoryTypeA WNetGetDirectoryTypeW WNetGetHomeDirectoryW WNetGetLastErrorA WNetGetLastErrorW WNetGetNetworkInformationA WNetGetNetworkInformationW WNetGetPropertyTextA WNetGetPropertyTextW WNetGetProviderNameA WNetGetProviderNameW WNetGetProviderTypeA WNetGetProviderTypeW WNetGetResourceInformationA WNetGetResourceInformationW WNetGetResourceParentA WNetGetResourceParentW WNetGetSearchDialog WNetGetUniversalNameA WNetGetUniversalNameW WNetGetUserA WNetGetUserW WNetLogonNotify WNetOpenEnumA WNetOpenEnumW WNetPasswordChangeNotify WNetPropertyDialogA WNetPropertyDialogW WNetRestoreAllConnectionsW WNetRestoreSingleConnectionW WNetSetConnectionA WNetSetConnectionW WNetSetLastErrorA WNetSetLastErrorW WNetSupportGlobalEnum WNetUseConnectionA WNetUseConnectionW __dbk_fcall_wrapper dbkFCallWrapperAddr

out.upx

SHA256 f66a80eddde00e2fca9cf0b2300a2c538d560b21e4a0a20526795bf810d2030f
MD5 91ee19a6f83a09924225f6176482cf1f
SHA1 d6761e69339c27cfa6b9a6bbe56a7e55acaac7e9
SHA512 c9ce79c1203111ad611f308b5a85edce928ef110c7f76acb95ea5ee72e827184ed9a22337131ad64647f067f672e8138e7308675dfc834d3779cd8c4906143a6
SSDEEP 196608:qCkdgEGQWSdx/1Z8CyiJX5ADaQsF9JGStE4W:qCked3ctZOiJXK+9YStET
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Detect Numando payload
ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3323080

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

.text

Size

3.2MB

Virtual Size

3.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

80KB

Virtual Size

79KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

26KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rdata

Size

512B

Virtual Size

69B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

270KB

Virtual Size

270KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

5.5MB

Virtual Size

5.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

JaffaCakes118_1ce590d9a12eb8af33f17ed9b5e2df3f

generic

out.upx

generic