jaffacakes118__9a9afe8ca996dbe68228d3add844b31f

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118__9a9afe8ca996dbe68228d3add844b31f
Size 147KB
Sample260919-seckbaszb1
SHA256 b7ffc7c1039d8a86b7aa8c1ac7df85a1d3c96806ebeb1b9703c0958ce7699cd6
MD5 9a9afe8ca996dbe68228d3add844b31f
SHA1 e4b0f767dccfc953ccebd255521bbd8ffd748ff9
SHA512 c17e901cb5d65cc88873aed7bd8047d397aeff551604fef01085f05973e2c9ce38fe47190e928e4d669db88d1441b9074d961d2b7f2035105050961c13ae496a
SSDEEP 3072:Y33cOOSnQISzdI2GkVdi8rSX4gxiFS3dd+Jt1ielRKkdsufycYAblWT0gBzzyGv0:9jSm5I2V4D4ggFk0iKJFWIgx50
TLSH
T18CE312971FF03CF27B10B98A2947640F1666793BDBE700BD7BB91839CBA66293525081
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

aspackv2 upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
static1/unpack001/winstyle3.dll	acprotect

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
static1/unpack001/prflbmsgp32.dll	aspack_v212_v242

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/winstyle3.dll	upx

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
unpack001/prflbmsgp32.dll
unpack001/q1816250_disk.dll
unpack001/winstyle3.dll
unpack002/out.upx

File Explorer

jaffacakes118__9a9afe8ca996dbe68228d3add844b31f

.zip 147KB
prflbmsgp32.dll

.dll 72KB
q1816250_disk.dll

.dll 24KB
winstyle3.dll

.dll 68KB
out.upx

.dll 160KB

jaffacakes118__9a9afe8ca996dbe68228d3add844b31f

SHA256 b7ffc7c1039d8a86b7aa8c1ac7df85a1d3c96806ebeb1b9703c0958ce7699cd6
MD5 9a9afe8ca996dbe68228d3add844b31f
SHA1 e4b0f767dccfc953ccebd255521bbd8ffd748ff9
SHA512 c17e901cb5d65cc88873aed7bd8047d397aeff551604fef01085f05973e2c9ce38fe47190e928e4d669db88d1441b9074d961d2b7f2035105050961c13ae496a
SSDEEP 3072:Y33cOOSnQISzdI2GkVdi8rSX4gxiFS3dd+Jt1ielRKkdsufycYAblWT0gBzzyGv0:9jSm5I2V4D4ggFk0iKJFWIgx50
TLSH
T18CE312971FF03CF27B10B98A2947640F1666793BDBE700BD7BB91839CBA66293525081
MD5 SHA1 SHA512 SSDEEP TLSH

prflbmsgp32.dll

SHA256 78da8064919a53679e002e2b802775067431042b8c611ebb10c6f09537c3bc84
MD5 9d404a24bc6cb5494f68db129a32f5f7
SHA1 fe476b849a1eb749a12cad3157cc955f72f5be8f
SHA512 fc8ca4fd5d86609b5472372031a23fbd195ab3333059487fa651dd8ad852f8d6e27b1dfdde137d45cbc64c792df03a6d5e5e26feb972d3c82f0dd66153a2cc7f
SSDEEP 1536:Yh+UdU7StTlbL9rLTfkalY9pRv82umfapZZz7OJh:G+UdN5o362Chz7Ov
TLSH
T170730225C95A9EC6D1C91C321BB4358E3767A2AF99F1E6231635007D3E3C37A488EF25
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

ASPack v2.12-2.42

Detects executables packed with ASPack v2.12-2.42

aspackv2
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

167937

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

54KB

Virtual Size

124KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

DATA

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

1KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

6KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.aspack

Size

5KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.adata

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

q1816250_disk.dll

SHA256 70e6092c463a659db7b32500f90057ffe70ba7b1939c23454928442126fd6599
MD5 8438d2e7216117ff0fba929c03882dbd
SHA1 73f62bf8310ad81504893fc893285bd2f6d7179f
SHA512 61cac73cb8ae6d2a624320d15e05dbfa41ee57b08001244058e2865a781a0a5d5c9574c5278d97e518143ed393be58bd990f5caac643b472386e75700a5be074
SSDEEP 384:jfD/sk+icqMcnL1sz9RW0730tzYdq/6oyrGeYE7aBauJ2X31:jbf+HqBL1sz9pcAqCoyrGeYE7juJkF
TLSH
T195B24A43F9C1CCB3D412DEB8CD26D29CFA3A36603E05113779AA1FDDC86E281561D696
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

21140

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

512B

Virtual Size

224B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

165B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

512B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

winstyle3.dll

SHA256 e283202b46f68f5a7f6bffd4fabc3bd693ef002cf804f42fcd17dacb959cdf8a
MD5 87912f6e7e126a0319b341134eb97d99
SHA1 db2311efedc42b6147689daf6eee72ca1a996a3d
SHA512 08eed7cb5457ff0ecb3a56f9cbad90274a4b62342da1e54d4e565ae251515cf253e3dc555832ebf8bf49db272de4b4f9e8ab41d45f4155263ed5010c33db6ccc
SSDEEP 1536:rkz2kWTccmsZ3lvSGuigBThBEyfS/skz+8JAcC29EjGVwOBrkJu8/Lkh:rkSkWTccms1nuTFh6/zzXJAcC29ESVfL
TLSH
T14363022CA5EB9920D511363D93F358094B4EA81FB24A47D1CECD77A84F5312336D92BB
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

206144

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

out.upx

SHA256 c3e0e8530b67b743b7f9202462a5f86c0107f8803331d8e6710b12a9bdcfa1c5
MD5 87f8125409f33c2dc29492be20385d4a
SHA1 a80bd958555b304beebab8b41b77722fcfb2d2c5
SHA512 db6b9bfd26ae4f2b64cf0a60edaa0704f5ea9affed59a463a26dfa712e8a78527dc645a01a883d68233a5e5846c17ea24e87ffe37f381e6a4b0d9afbdf6f2774
SSDEEP 3072:2NgHM56HsINdpW4cFIxAEf/1rAUk87gYzFbv3XOI+HRNRyTXc55ZoNdGBKEXv2:wgHM56HsIN3W4cNEf/1DlzFboHReTLun
TLSH
T1CFF35C7BF1C08577E2621A7CEC8A91DCB42A7E113D29685F7AE40F0C8B3D6D1652A1C7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

144608

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

137KB

Virtual Size

137KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

166B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

jaffacakes118__9a9afe8ca996dbe68228d3add844b31f

prflbmsgp32.dll

generic

q1816250_disk.dll

generic

winstyle3.dll

generic

out.upx

generic