jaffacakes118_Trojan-Dropper[.]Win32[.]Taob[.]dr[.]14fc403470482febd6890789f79a31f0

General

Target
jaffacakes118_Trojan-Dropper.Win32.Taob.dr.14fc403470482febd6890789f79a31f0
Size 193KB
Sample261009-s8b6msax9s
SHA256 5db467ce5d137b02a2badcb4e823c5fa3ae431bcf841cb73e5c17d34a60717fd
MD5 14fc403470482febd6890789f79a31f0
SHA1 c2b35de8ef3b88f1804f305eab158fa51bdccb2f
SHA512 47e7b406c597703f6a479c60dde3d6b5a46113bc430904b717e9fcba6a029ea462fbeee7e4f5fd6544d573e86fed1939512821f35a08326a2a13522de87b52c7
SSDEEP 6144:Op+e1lnry8cW8JcThj4cqorhJ+IgpSx7AcZ/Be:sf1lryZW8JGdyof1p/M
TLSH
T1CD1412D6638F4A34E707A2E57266626484122CCD269DA83EF02DB8C4CF547C1E7E91F7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
static1/unpack001/ol-201006231095/xxjpq.exe	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/ol-201006231095/xxjpq.exe

jaffacakes118_Trojan-Dropper.Win32.Taob.dr.14fc403470482febd6890789f79a31f0

.zip 193KB
ol-201006231095/xxjpq.exe

.exe 213KB

SHA256 5db467ce5d137b02a2badcb4e823c5fa3ae431bcf841cb73e5c17d34a60717fd
MD5 14fc403470482febd6890789f79a31f0
SHA1 c2b35de8ef3b88f1804f305eab158fa51bdccb2f
SHA512 47e7b406c597703f6a479c60dde3d6b5a46113bc430904b717e9fcba6a029ea462fbeee7e4f5fd6544d573e86fed1939512821f35a08326a2a13522de87b52c7
SSDEEP 6144:Op+e1lnry8cW8JcThj4cqorhJ+IgpSx7AcZ/Be:sf1lryZW8JGdyof1p/M
TLSH
T1CD1412D6638F4A34E707A2E57266626484122CCD269DA83EF02DB8C4CF547C1E7E91F7
MD5 SHA1 SHA512 SSDEEP TLSH

SHA256 31b7dd817959a9b0920fc7ff2fd7875c1b7864e10f8d88c76dee387c567420b3
MD5 09140a8bbe563ab16289f56434b5894e
SHA1 695c30ff4c1552a5ea8f579c87f2abbb34acda47
SHA512 aa2f08e68c285bcde0dd849193bc4063380a79aebc58b1bd31a1b8731b5ffe879ee7e8dc8b56432905185a6bff3e73d61dacd7af8d6bdc9d24e21036db25566a
SSDEEP 6144:toAOct1ry8cWaJcThj4cuorhJ+Igp6x7AQ63ooSOtAeM:toAOMyZWaJGdGof7f64oSOtAe
TLSH
T1732402212379D9A4D141A07AEBD618F88022FC9BDA05F15F70D57EDF7E32ED28802167
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

587792

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths