jaffacakes118_Trojan[.]Win32[.]Agent[.]nchq[.]3140795504aba167f4011ee5285a1cf8

General

Target
jaffacakes118_Trojan.Win32.Agent.nchq.3140795504aba167f4011ee5285a1cf8
Size 519KB
Sample261016-bx49lsvwct
SHA256 2c9a35b4993fc3da04681c39a2d8b3c0f17428a4d475abd527bd6bbaf225ccb7
MD5 3140795504aba167f4011ee5285a1cf8
SHA1 a7c49b9c2a450d890a717b656100220afd8a3bd9
SHA512 c96fee46e751c96241a709201a2e97294b706eea93a6006540eaa21e15750b86b09c378c8526eb76b3c052df5ea876bab9c4737d0c41899c608fcdd677d5e842
SSDEEP 12288:e8Yn0/j15QYxZmXalvfDKobHB2zw2wTc/E59gPYsmZyO0vor:FY0/L8kH+wQ/u9/Joo
TLSH
T18AB49E85E68A7C8FCF595134A8D4947FD0D2E0AB3F9044B815AFE18B4B9C2E64C127DE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan.Win32.Agent.nchq.3140795504aba167f4011ee5285a1cf8

jaffacakes118_Trojan.Win32.Agent.nchq.3140795504aba167f4011ee5285a1cf8

.exe 519KB

SHA256 2c9a35b4993fc3da04681c39a2d8b3c0f17428a4d475abd527bd6bbaf225ccb7
MD5 3140795504aba167f4011ee5285a1cf8
SHA1 a7c49b9c2a450d890a717b656100220afd8a3bd9
SHA512 c96fee46e751c96241a709201a2e97294b706eea93a6006540eaa21e15750b86b09c378c8526eb76b3c052df5ea876bab9c4737d0c41899c608fcdd677d5e842
SSDEEP 12288:e8Yn0/j15QYxZmXalvfDKobHB2zw2wTc/E59gPYsmZyO0vor:FY0/L8kH+wQ/u9/Joo
TLSH
T18AB49E85E68A7C8FCF595134A8D4947FD0D2E0AB3F9044B815AFE18B4B9C2E64C127DE
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

366912

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths