jaffacakes118_9c9c742521d7fc635aeea9e5a69122960c1027fc7a1e7fbc8ba54eaa9ce5182a[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_9c9c742521d7fc635aeea9e5a69122960c1027fc7a1e7fbc8ba54eaa9ce5182a.bin
Size 23.2MB
Sample261016-2x2ftssvby
SHA256 9c9c742521d7fc635aeea9e5a69122960c1027fc7a1e7fbc8ba54eaa9ce5182a
MD5 d68c8c99a141ebe2157ea8f2336254cd
SHA1 963857df0df0460681f58283f4b4b448c3acc9a5
SHA512 28e5987fb329aa91e1398443e0fd20bf1f830683f69d29b98927fcfbc677a7aec2cfba4f0bf40f21007bfb7c408340f271411188b762b5cf88911ac43365e81d
SSDEEP 393216:xOTLRoWAS5a0N7ux+/Pi0+odWwdazIawx1V99BYwZk/D6h+sRN2eGFyu7suU:xILRoWt5n9EmPjdWwuA1VLBHZGD2N2eH
TLSH
T17C37330C35A1BDF8F8D6D2B2164B7A43A011619D3BC31C9EE42461ED3243F756FE896A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

revoked_codesign upx

Malware Config

Signatures

Revoked Certificate in Chain 1 IoCs

One or more certificates in the signing chain have been revoked, indicating potential compromise.

revoked_codesign

resource
jaffacakes118_9c9c742521d7fc635aeea9e5a69122960c1027fc7a1e7fbc8ba54eaa9ce5182a.bin

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/out.upx

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
jaffacakes118_9c9c742521d7fc635aeea9e5a69122960c1027fc7a1e7fbc8ba54eaa9ce5182a.bin

File Explorer

jaffacakes118_9c9c742521d7fc635aeea9e5a69122960c1027fc7a1e7fbc8ba54eaa9ce5182a.bin

.exe 23.2MB
out.upx

.exe 2.8MB

jaffacakes118_9c9c742521d7fc635aeea9e5a69122960c1027fc7a1e7fbc8ba54eaa9ce5182a.bin

SHA256 9c9c742521d7fc635aeea9e5a69122960c1027fc7a1e7fbc8ba54eaa9ce5182a
MD5 d68c8c99a141ebe2157ea8f2336254cd
SHA1 963857df0df0460681f58283f4b4b448c3acc9a5
SHA512 28e5987fb329aa91e1398443e0fd20bf1f830683f69d29b98927fcfbc677a7aec2cfba4f0bf40f21007bfb7c408340f271411188b762b5cf88911ac43365e81d
SSDEEP 393216:xOTLRoWAS5a0N7ux+/Pi0+odWwdazIawx1V99BYwZk/D6h+sRN2eGFyu7suU:xILRoWt5n9EmPjdWwuA1VLBHZGD2N2eH
TLSH
T17C37330C35A1BDF8F8D6D2B2164B7A43A011619D3BC31C9EE42461ED3243F756FE896A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Revoked Certificate in Chain

One or more certificates in the signing chain have been revoked, indicating potential compromise.

revoked_codesign
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

58:d1:f1:56:cc:b6:c1:03:fd:5f:60:49:0b:32:da:07:66:25:00:04

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=James Caulfield,O=James Caulfield,POSTALCODE=60506,STREET=2112 West Galena Blvd. Unit 8-515,L=Aurora,ST=Illinois,C=US

Chains

Oct 15, 2026

CN=James Caulfield,O=James Caulfield,POSTALCODE=60506,STREET=2112 West Galena Blvd. Unit 8-515,L=Aurora,ST=Illinois,C=US

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Minor OS version

Major OS version

Entry point

3022560

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

out.upx

SHA256 7900c94eefeda415f284e5ed77e598c27b15516095a237316a55e71b8e724929
MD5 c6668bfde7e92c6f24a68cd9403f9c77
SHA1 8cc16fbae26313ba35778c0a19789a9d72dfb41a
SHA512 c4fde704d2a4caaf6d67f9a41a57bbd9611cd042ef78b5cee8032aa6b07b5a25c15c6773e9c589b8319a83a31a8fbd0354f4f26394b70f00ccf51d89e0358e20
SSDEEP 24576:8PpsshpxJU1klSPO8TW/J1VCF7mA+3ZASBiD2PHXeQb8D8r1a8Nu2LKHn0PZnzrz:8P9U1NO8w5AiBoxUXuSfjEhqJFT
TLSH
T1F2D54C13B24AA53FC0BF1A329937C954983F77617A16CD8B57F4090C8E796506F3AE0A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2606780

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

.text

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

38KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

22KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

91B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

Virtual Size

64B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

93B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

217KB

Virtual Size

216KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

70KB

Virtual Size

70KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

jaffacakes118_9c9c742521d7fc635aeea9e5a69122960c1027fc7a1e7fbc8ba54eaa9ce5182a.bin

PE Signature issue

generic

out.upx

generic