jaffacakes118_UDS[.]DangerousObject[.]Multi[.]Generic[.]e97abb6897c397866392a6162ef446c3

resource	yara_rule
sample	upx
static1/unpack001/Uninst.exe	upx

resource
jaffacakes118_UDS.DangerousObject.Multi.Generic.e97abb6897c397866392a6162ef446c3
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/DeskScan.exe
unpack001/Uninst.exe
unpack002/out.upx
unpack001/out.upx

jaffacakes118_UDS.DangerousObject.Multi.Generic.e97abb6897c397866392a6162ef446c3

SHA256 c79e3ec3e497a744370c986a92843b696ed0e8256e4892b5e32f14e4c71490b4
MD5 e97abb6897c397866392a6162ef446c3
SHA1 6a53f8c6699b4f31d8afcb563197cede51fc0f48
SHA512 4244bc39c65f2c35e9d6ee0f928c1db48a8187116609a2e58d47d81611c5b532ea4495bf744ae0c85c33585f04d1a87375ba30ecd16c3f14c0bf448962a0a72d
SSDEEP 6144:l3aB5h95akNg6vla4CxlBqm32ZwKT2Us3kTqRbax6tmn/OWqZbxYzhurx:l3aB5ptSolDyl8m30TqcqRbKn/OWq9CG
TLSH
T153742330B312AFC7C7631935621F1A4C1FED9D956628CBEA0E104EBEDD297478DA4D22
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

213792

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

$PLUGINSDIR/InstallOptions.dll

IMPHASH 922b855d216a21490e4bcbf6c29b7f7d
SHA256 a505e6c537a5ce0166227dda9f7671605395592ac9f1a3764e8a01b713939db1
MD5 07f3b3445f66e1089567796bf3c8be78
SHA1 851eb574c1067b23a654f8aa47b17ef599b24d1c
SHA512 8c56308fff3a947b26fd0d98dbdd96c406ddf967f5d7abee8cba082b6c46a4e575094bb0bb981551ac5160bb5089cf6fb125dd17a659c427e28c07402adab1c3
SSDEEP 192:pzi5iBjGHp29db9Dd+w6VPESclh3I8dYvwqu7hwbbHF1QuCb:pO5kjGHSDdgjo6pvwqu72bbMum
TLSH
T1CE422A6223849CF3E795423AB0563B036B9696267D516ED1C7330FC67E2308E6EB6353
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10288

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/ioSpecial.ini

SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
MD5 e2d5070bc28db1ac745613689ff86067
SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
TLSH
T1D3D0C9C9501A802944208642A97A2FA263E03E210B1725FAF5724C87EB4CDE79C9D682
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

DeskScan.exe

SHA256 2c84837c38b25da1df53d8570fb6a5572d6fae1b862a693ab6995b15b0361894
MD5 2d7b2405c2e30f7b23dc5bf6ec01f506
SHA1 ce953351257cf492423286ff64690413aaab11b9
SHA512 dd2d280949bbee0e9cbc576b3742a18ca73bb8705ea7cea6d7184fe0db985c220e841f064e04b25306508b2663980f92e1534e54f6da54ba6731409362ec60d4
SSDEEP 6144:fk0Tv4GQrh5660gitoZEewFJ4yzg5ulVq2hzcmNTeeNFqxt+HaNAJ:fk0Tv4Go56di/mKyzg5u24TVGxtya
TLSH
T17D541326846A5CF1E211333057EA5FDCEDA1D4F7A8C52EE567C41ACDAD381803EB25AC
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

769840

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Uninst.exe

SHA256 5d7bc9c4f834e60960d17468d24728e4455f301f628e3297507e4f8c50b269cb
MD5 18974ec55696a48dae33da7ef31a67cc
SHA1 f85d32db0a490c7f8dfc16326116dbe513edbf89
SHA512 280ef9365a6d878b4ba5ba7494773cbcb0764e51e13dfb1d605d337d209cbcb6369b42ab9d21749fdc823bc3f293164bfd6e1c90e29d284483215be57625abc0
SSDEEP 768:cdVi2W/V4wf1Or+3JRn7Am6kRRG2iZF9gtJlp:I2/VfF7APLD9g9p
TLSH
T1F3F2D00676450CDDCFBE017086869EBC3AF4E5605B5CC7331A419A1FEDBA385AE204AF
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

213792

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

out.upx

SHA256 898fb1c0ed0955a910aac3f574ddb502bf1cfcc6e07a03b1f048d98a2c2a4894
MD5 f9c25464ee3bd8983f47fe16f8008dd8
SHA1 c2933527ec4c882c882ccb6eede9643b858ee035
SHA512 83364f54e14f2bd0e863721841f22dd955c9f9213885ee19acb9821c6745290b13a1a9c7760236c8906e6391d92e2d4adbe10fbe1b5e22256c9958b126f1e044
SSDEEP 768:89qrF6FbV5v+rf2C+9ReyFJefClbu9c+3JRn7Am6kRRG2iZF9g:88rF6Fjs2Buk40ud7APLD9g
TLSH
T16623AE1632D0DCA3DE6705B00EBF6BB5F7F1A6101511AB2747504F7EA936282EE0A05B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

15981

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

file_id.diz

SHA256 b4937aa5f511156b3cd5385afce1a8f747ba12064021bfab282d36b8cf09b662
MD5 c7606100c45e1122b0db2331398e6ee0
SHA1 f411079f83d0bb3e107fc674a63dfb33610876eb
SHA512 f8447e4ad89e36706eae37d6221eb3e08b0eb1b477524d78153268b601f00db601c000f1e4a883b6ad7eb5aa92fc2abd39ba5132caff63ab0ebcade87683cb8d
TLSH
T127E0868BE4D18CA4480579CEAA0747C5421659A2213A14650A0C363EDA3DF5B36D5B49
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

info.pdf

SHA256 5e08072c5adc0dae086cd72520267cbdffd28053e31382db93a60de31a0208be
MD5 dcdf553ffa25104b24078feb36d9bd43
SHA1 6597bec14a285d17f3d067670a1ff440c174c453
SHA512 f1e1cfc819b2848982a83a17c75247664b58db594d9b14acc7962ac3ca36dc5bc675f711210825ac403051fb3baeceb3a8bee3e64e423480bbb35d88e88de423
SSDEEP 96:yM0JLMl3BKkfFvB6+lCV1WZkeWULXBydqyVBqhT9p7zGwN25QzqacfaeffYf5fBf:VQ4l3BKeFZCV1eWULXBydqYm9bNqQzqG
TLSH
T117B13B9AF5B81B4CFC51DB9F5AAE369E072D7123D2C469F010294F48A484C805F623F7
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

Extracted URLs

file http://www.paehl.de

out.upx

SHA256 47700a78863bb111e3e3254ae2bbbc2a0ba8057f8eb88fe55d2dafb74276e7de
MD5 1e376cc9250c066ae3923367d3ea6f54
SHA1 4eb16e50069cfefc61bf222d441b8db293ec8b0f
SHA512 d1d3e1d25ff9db8b94bb8fd9178ca34ee103f938177f73c169fe71654e2a3493a8bb1baa3c68724be02c38ddca6c9236730bdd2a4a01b1dac7861a0c80d039fe
SSDEEP 768:89qrF6FbV5v+rf2C+9ReyFJefClbu9LZlMZe+/lg4Ro:88rF6Fjs2Buk40uv+/G4Ro
TLSH
T10223AE22B2D0DC73EE2715714DBB97B5E3F29A101221E7471B509F7EAC32192ED0A09B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

15981

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

jaffacakes118_UDS.DangerousObject.Multi.Generic.e97abb6897c397866392a6162ef446c3

generic

$PLUGINSDIR/InstallOptions.dll

kernel32

user32

gdi32

comdlg32

shell32

generic

$PLUGINSDIR/ioSpecial.ini

$PLUGINSDIR/modern-wizard.bmp

DeskScan.exe

generic

Uninst.exe

generic

out.upx

generic

file_id.diz

info.pdf

Extracted URLs

out.upx

generic

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_UDS.DangerousObject.Multi.Generic.e97abb6897c397866392a6162ef446c3

generic

$PLUGINSDIR/InstallOptions.dll

kernel32

user32

gdi32

comdlg32

shell32

generic

$PLUGINSDIR/ioSpecial.ini

$PLUGINSDIR/modern-wizard.bmp

DeskScan.exe

generic

Uninst.exe

generic

out.upx

generic

file_id.diz

info.pdf

Extracted URLs

out.upx

generic