jaffacakes118_acd84a85ab66b44b9f99b90502df8239fa6605d3dfad612a0cb6350712d1fa50[.]bin

General

Target
jaffacakes118_acd84a85ab66b44b9f99b90502df8239fa6605d3dfad612a0cb6350712d1fa50.bin
Size 179KB
Sample260922-xxevlsde99
SHA256 acd84a85ab66b44b9f99b90502df8239fa6605d3dfad612a0cb6350712d1fa50
MD5 63f86e8d13fdacec22965e97748b1416
SHA1 95b542470b0e94d598e66910b9f4edad0c80c3f9
SHA512 a7c3fac822a8dfe361370d4f578c29d26f13fc97e761fbf439e7283795b674555d4fdde142ec496b963e4adc9ef7ba50591ed0f4fb968d1c1941fa9a342a0aea
SSDEEP 3072:dwjS+GVC16884FLcuF8n5f5qSrpcPf1/FIIHy0vOrXZi:df+Gg1ZJg6G5Rjrp6f1/FtSni
TLSH
T194047B25B791D032D093103189B8CBB6AC78F9312B7550D7F3A86B7E5EB02E15A3935B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
jaffacakes118_acd84a85ab66b44b9f99b90502df8239fa6605d3dfad612a0cb6350712d1fa50.bin

File Explorer

jaffacakes118_acd84a85ab66b44b9f99b90502df8239fa6605d3dfad612a0cb6350712d1fa50.bin

.exe 179KB

jaffacakes118_acd84a85ab66b44b9f99b90502df8239fa6605d3dfad612a0cb6350712d1fa50.bin

IMPHASH 928ac9368e233d6d04fd2d02710a1719
SHA256 acd84a85ab66b44b9f99b90502df8239fa6605d3dfad612a0cb6350712d1fa50
MD5 63f86e8d13fdacec22965e97748b1416
SHA1 95b542470b0e94d598e66910b9f4edad0c80c3f9
SHA512 a7c3fac822a8dfe361370d4f578c29d26f13fc97e761fbf439e7283795b674555d4fdde142ec496b963e4adc9ef7ba50591ed0f4fb968d1c1941fa9a342a0aea
SSDEEP 3072:dwjS+GVC16884FLcuF8n5f5qSrpcPf1/FIIHy0vOrXZi:df+Gg1ZJg6G5Rjrp6f1/FtSni
TLSH
T194047B25B791D032D093103189B8CBB6AC78F9312B7550D7F3A86B7E5EB02E15A3935B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

52:d6:2a:d3:bc:a2:85:b5:a8:58:2c:69:75:8b:cb:d9

Digest Algorithm

md5

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=F5 Networks Inc,O=F5 Networks Inc,L=Seattle,ST=Washington,C=US

Chains

Jan 1, 0001

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=F5 Networks Inc,O=F5 Networks Inc,L=Seattle,ST=Washington,C=US

Serial Number

12:3b:92:d6:69:6f:02:74:00:00:00:00:55:66:25:5d

Issuer

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 25, 2017 - Dec 12, 2019

Subject

Serial Number

43:c1:0b:1c:00:00:00:00:51:d3:73:da

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 10, 2015 - Nov 10, 2030

Minor OS version

1

Major OS version

5

Entry point

64963

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

G:\cc-builds\apmclients12.1.3-win\986157\src\rh\TerminalProxy\StandaloneCtrl\out\Release\f5StandaloneCtrl.pdb

scew_uls

ord128 ord119 ord116 ord124 ord126 ord115 ord137 ord140 ord142 ord131 ord132 ord134 ord133 ord146 ord152 ord110 ord129 ord151 ord139

kernel32

GetLastError FindClose FindFirstFileA ReleaseMutex WaitForSingleObject CreateMutexA CloseHandle LocalFree GetCurrentProcess GetModuleHandleA OutputDebugStringA GetCurrentThreadId InterlockedDecrement InterlockedIncrement GetSystemTime DeleteCriticalSection FormatMessageA CopyFileA QueryPerformanceCounter GetSystemInfo GetCurrentProcessId GetTickCount GetVersionExA Sleep GetVersion HeapFree HeapAlloc GetProcessHeap LocalAlloc FlushFileBuffers CreateFileA CreateFileW LoadLibraryA WideCharToMultiByte GetModuleFileNameA GetTempPathA MultiByteToWideChar CreateEventA InterlockedExchange GetLocalTime InterlockedCompareExchange SetUnhandledExceptionFilter CreateProcessA TlsGetValue TlsAlloc TerminateProcess IsDebuggerPresent UnhandledExceptionFilter LoadLibraryW InitializeCriticalSectionAndSpinCount HeapCreate HeapSetInformation GetCommandLineA SetEndOfFile RaiseException RtlUnwind EncodePointer DecodePointer ExitProcess GetModuleHandleW TlsFree SetLastError GetProcAddress FreeLibrary LeaveCriticalSection EnterCriticalSection lstrlenA WriteFile EnumResourceLanguagesA GetStdHandle GetModuleFileNameW GetCPInfo GetACP GetOEMCP IsValidCodePage IsProcessorFeaturePresent GetConsoleCP GetConsoleMode LCMapStringW SetHandleCount GetFileType GetStartupInfoW SetStdHandle SetFilePointer HeapSize FreeEnvironmentStringsW GetEnvironmentStringsW GetSystemTimeAsFileTime GetStringTypeW WriteConsoleW HeapReAlloc ReadFile TlsSetValue

user32

RegisterWindowMessageA FindWindowA SendMessageTimeoutA IsWindow LoadIconA PostQuitMessage wsprintfA RegisterClassExA LoadCursorA PeekMessageA TranslateMessage DispatchMessageA DefWindowProcA CreateWindowExA

advapi32

GetSidSubAuthority RegQueryInfoKeyA GetTokenInformation OpenProcessToken RegQueryValueExA RegOpenKeyExA RegCloseKey RegEnumKeyExA GetSidSubAuthorityCount

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_acd84a85ab66b44b9f99b90502df8239fa6605d3dfad612a0cb6350712d1fa50.bin

PE Signature issue

scew_uls

kernel32

user32

advapi32

generic