jaffacakes118_e31ccabcb1475eb727a561a19303cdfebe74843736a01ef29ef7e39ef8258698[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_e31ccabcb1475eb727a561a19303cdfebe74843736a01ef29ef7e39ef8258698.bin
Size 2.7MB
Sample261015-zzswcssvev
SHA256 e31ccabcb1475eb727a561a19303cdfebe74843736a01ef29ef7e39ef8258698
MD5 7965a5f0640dff62b5e9a0e5d1de8156
SHA1 3921825ff81566f7f34d34e6ea40b8b758a25342
SHA512 fc5f799543b3c147f31ebcff5fa5806129faf97df7ea5b6e3bd78fe6ce19ca947215c2e6916789003d0ada873ecc40edd942689d5fba519f480b7a64ddc2b73a
SSDEEP 49152:2S55e6zSNSw4bEU6DRRgp2A3fGGal9jFSWQ+UEYYkUvDtcEAE/rC1hiLg3:zRmSw4lcRRgp2A3fNg6FLpUvDtcEAceV
TLSH
T12DD533C336824838F0478477B31A7B643B1D78324975CE1F75B9F88D4AF5AA146AA70B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_e31ccabcb1475eb727a561a19303cdfebe74843736a01ef29ef7e39ef8258698.bin
unpack001/out.upx

File Explorer

jaffacakes118_e31ccabcb1475eb727a561a19303cdfebe74843736a01ef29ef7e39ef8258698.bin

.exe 2.7MB
out.upx

.exe 4.9MB

jaffacakes118_e31ccabcb1475eb727a561a19303cdfebe74843736a01ef29ef7e39ef8258698.bin

SHA256 e31ccabcb1475eb727a561a19303cdfebe74843736a01ef29ef7e39ef8258698
MD5 7965a5f0640dff62b5e9a0e5d1de8156
SHA1 3921825ff81566f7f34d34e6ea40b8b758a25342
SHA512 fc5f799543b3c147f31ebcff5fa5806129faf97df7ea5b6e3bd78fe6ce19ca947215c2e6916789003d0ada873ecc40edd942689d5fba519f480b7a64ddc2b73a
SSDEEP 49152:2S55e6zSNSw4bEU6DRRgp2A3fGGal9jFSWQ+UEYYkUvDtcEAE/rC1hiLg3:zRmSw4lcRRgp2A3fNg6FLpUvDtcEAceV
TLSH
T12DD533C336824838F0478477B31A7B643B1D78324975CE1F75B9F88D4AF5AA146AA70B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5218480

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

out.upx

SHA256 3f483d3c670aa33ed3e67257d2b847322d73d0aadca42cf26d5b6d3c4008d525
MD5 1e3a4db380aad67e41d6a7e26dacdbb3
SHA1 d07db09199b0418524b082ccf34caa497a532647
SHA512 eec9b7cb533374c99f55a330ad722b59f27d1f39b01d666f6e89262fc3584419c3308c1ea7482b97c955aae5cefa49ee6f866ea10e9062967afd4541d31d7ced
SSDEEP 98304:NPYr6666666666666666666666666666666x666666666666666fwwwwwwwwwwwe:A2ActJ9BX4Zermpfqnh381EmcbomF1m7
TLSH
T16D368D02F5955025E5FB26B1FC3CA7391B253E198FF184EBB2912C482FB02D1763679A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

94140

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

281KB

Virtual Size

281KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

55KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.voltbl

Size

512B

Virtual Size

126B

Characteristics

Name

.rsrc

Size

4.6MB

Virtual Size

4.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

jaffacakes118_e31ccabcb1475eb727a561a19303cdfebe74843736a01ef29ef7e39ef8258698.bin

generic

out.upx

generic