jaffacakes118_not-a-virus[.]HEUR[.]Downloader[.]Win32[.]Generic[.]437fbf2fdbe23a860df3aacba5b8f97c

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_not-a-virus.HEUR.Downloader.Win32.Generic.437fbf2fdbe23a860df3aacba5b8f97c
Size 422KB
Sample261014-fpxxsaee76
SHA256 9e5f7a698faf4c5ad91ec8c7fee033a923f5a8ba6ab969fb18987199867176fe
MD5 437fbf2fdbe23a860df3aacba5b8f97c
SHA1 6dc2ce61dba982d935367410667e52e4ed85a657
SHA512 769042bf386296d658e16bac0a27b53d0a91aedfc87fa9cd2dbbc5234d8a79cd769f9631a96969dc9063e7b7d0f4ef7064ec5c3f149015798cdaf52714865917
SSDEEP 12288:rwaA3t7VPRw+8cOSQN2jyGFyFjISvfsJJa/oSdD:Upbw+8cze/jL4U7D
TLSH
T1B5941291B7181814E384993464EFEF73226A99867EF0C7A315257C8FBDD2690BF6013E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
jaffacakes118_not-a-virus.HEUR.Downloader.Win32.Generic.437fbf2fdbe23a860df3aacba5b8f97c

File Explorer

jaffacakes118_not-a-virus.HEUR.Downloader.Win32.Generic.437fbf2fdbe23a860df3aacba5b8f97c

.exe 422KB

jaffacakes118_not-a-virus.HEUR.Downloader.Win32.Generic.437fbf2fdbe23a860df3aacba5b8f97c

SHA256 9e5f7a698faf4c5ad91ec8c7fee033a923f5a8ba6ab969fb18987199867176fe
MD5 437fbf2fdbe23a860df3aacba5b8f97c
SHA1 6dc2ce61dba982d935367410667e52e4ed85a657
SHA512 769042bf386296d658e16bac0a27b53d0a91aedfc87fa9cd2dbbc5234d8a79cd769f9631a96969dc9063e7b7d0f4ef7064ec5c3f149015798cdaf52714865917
SSDEEP 12288:rwaA3t7VPRw+8cOSQN2jyGFyFjISvfsJJa/oSdD:Upbw+8cze/jL4U7D
TLSH
T1B5941291B7181814E384993464EFEF73226A99867EF0C7A315257C8FBDD2690BF6013E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

86:54:52:cc:94:4f:d1:3a:1c:d7:af:06:29:4d:9f:5f

Digest Algorithm

md5

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=ProNord GmbH & Co. KG,O=ProNord GmbH & Co. KG,POSTALCODE=24941,STREET=Graf-Zeppelin-Str. 20,L=Flensburg,ST=Schleswig-Holstein,C=DE

Chains

Jan 1, 0001

Subject

CN=ProNord GmbH & Co. KG,O=ProNord GmbH & Co. KG,POSTALCODE=24941,STREET=Graf-Zeppelin-Str. 20,L=Flensburg,ST=Schleswig-Holstein,C=DE

Serial Number

51:a5:6f:2e:e7:fe:c9:27:f4:f8:37:39:09:4d:11:eb

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 11, 2012 - May 11, 2014

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 24, 2011 - May 30, 2020

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Serial Number

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jun 7, 2005 - May 30, 2020

Subject

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Serial Number

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 30, 2000 - May 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Serial Number

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 1, 2012 - Dec 31, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Minor OS version

Major OS version

Entry point

2073136

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_not-a-virus.HEUR.Downloader.Win32.Generic.437fbf2fdbe23a860df3aacba5b8f97c

PE Signature issue

generic