jaffacakes118_26317ef31ba33e143b73cc40cb1f4670a41339f4a714d3ea07cd6210a6263984[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_26317ef31ba33e143b73cc40cb1f4670a41339f4a714d3ea07cd6210a6263984.bin
Size 1.2MB
Sample260924-nrccvscf82
SHA256 26317ef31ba33e143b73cc40cb1f4670a41339f4a714d3ea07cd6210a6263984
MD5 747dadd01cc80f35d9cad6136b9f7930
SHA1 dade225ccd02ba948b9de9e95af52eb7a92d546e
SHA512 c4b5b6480bcab9d5936cafb146d17fb96b4c903e861af23a49ce508cf5d9be701df28ee015beb4bc02dbbb17b7222357774a1e7d7b4200743b3818bb8980c582
SSDEEP 24576:leMCJ35/59uE6tIHPFX3faHOYt4OZqaqCvgu1Hg:kMCJ3VujtsXAOYKOZj191Hg
TLSH
T17D451218B0D1C873D07215361EE59AB69C3EF9680A95BEDF23D91F7F0910381BA349A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
jaffacakes118_26317ef31ba33e143b73cc40cb1f4670a41339f4a714d3ea07cd6210a6263984.bin

File Explorer

jaffacakes118_26317ef31ba33e143b73cc40cb1f4670a41339f4a714d3ea07cd6210a6263984.bin

.exe 1.2MB

jaffacakes118_26317ef31ba33e143b73cc40cb1f4670a41339f4a714d3ea07cd6210a6263984.bin

IMPHASH 42a9a04d093acea5d87d09e3defddcb0
SHA256 26317ef31ba33e143b73cc40cb1f4670a41339f4a714d3ea07cd6210a6263984
MD5 747dadd01cc80f35d9cad6136b9f7930
SHA1 dade225ccd02ba948b9de9e95af52eb7a92d546e
SHA512 c4b5b6480bcab9d5936cafb146d17fb96b4c903e861af23a49ce508cf5d9be701df28ee015beb4bc02dbbb17b7222357774a1e7d7b4200743b3818bb8980c582
SSDEEP 24576:leMCJ35/59uE6tIHPFX3faHOYt4OZqaqCvgu1Hg:kMCJ3VujtsXAOYKOZj191Hg
TLSH
T17D451218B0D1C873D07215361EE59AB69C3EF9680A95BEDF23D91F7F0910381BA349A7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

71:d0:8e:eb:af:d4:18:3d:3e:d2:90:b3:58:17:ff:fc:25:35:ae:42:91:4d:a6:c5:2e:c8:ee:a1:7b:19:76:bd

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=5567037485,CN=Spotify AB,O=Spotify AB,L=Stockholm,C=SE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025345

Chains

Mar 13, 2023

SERIALNUMBER=5567037485,CN=Spotify AB,O=Spotify AB,L=Stockholm,C=SE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025345

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=5567037485,CN=Spotify AB,O=Spotify AB,L=Stockholm,C=SE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025345

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=5567037485,CN=Spotify AB,O=Spotify AB,L=Stockholm,C=SE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025345

Serial Number

04:c5:30:70:3a:21:0e:c1:d6:f8:3c:b4:fe:11:18:c5

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 22, 2022 - Oct 19, 2023

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

30953

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

user32

GetPointerTouchInfo

kernel32

LoadLibraryExW CreateFileW FreeConsole WideCharToMultiByte MultiByteToWideChar GetStringTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW HeapSize RaiseException RtlUnwind GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress WriteConsoleW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapFree HeapAlloc CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType GetFileSizeEx SetFilePointerEx CloseHandle FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetProcessHeap ReadConsoleW

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_26317ef31ba33e143b73cc40cb1f4670a41339f4a714d3ea07cd6210a6263984.bin

PE Signature issue

user32

kernel32

generic