jaffacakes118_2e6cd039a1e738a1968fd27f6761809239606844e258e7e60d97ee19770513f2[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_2e6cd039a1e738a1968fd27f6761809239606844e258e7e60d97ee19770513f2.bin
Size 2.7MB
Sample261018-1f72lsvyex
SHA256 2e6cd039a1e738a1968fd27f6761809239606844e258e7e60d97ee19770513f2
MD5 e8fff8d684f62617e9c12d668e343d21
SHA1 c799dbaf34c2b46dcf60bd9c2deb823767e5dd85
SHA512 a425b371811d942d503041e49814299f0028cf3121796a42416d890a2df007a0e2e3a6118b33d0cd9c9f362dee3fb9981a5b0df6cca27a19019c4eedc6929b60
SSDEEP 49152:Zu1+/STj7r5uOey284AjD6N3dK62Y092b/9S71OR8dIIl0M6AMR7dbhmbRgKtb54:tSTjh+w4AjDS062BED9S+WqtAkdboFgx
TLSH
T183D533D677908474F00541BB7069B762DA1D7C388F3DCD1B62F9BD894AF429282C8ADB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_2e6cd039a1e738a1968fd27f6761809239606844e258e7e60d97ee19770513f2.bin
unpack001/out.upx

File Explorer

jaffacakes118_2e6cd039a1e738a1968fd27f6761809239606844e258e7e60d97ee19770513f2.bin

.exe 2.7MB
out.upx

.exe 5.1MB

jaffacakes118_2e6cd039a1e738a1968fd27f6761809239606844e258e7e60d97ee19770513f2.bin

SHA256 2e6cd039a1e738a1968fd27f6761809239606844e258e7e60d97ee19770513f2
MD5 e8fff8d684f62617e9c12d668e343d21
SHA1 c799dbaf34c2b46dcf60bd9c2deb823767e5dd85
SHA512 a425b371811d942d503041e49814299f0028cf3121796a42416d890a2df007a0e2e3a6118b33d0cd9c9f362dee3fb9981a5b0df6cca27a19019c4eedc6929b60
SSDEEP 49152:Zu1+/STj7r5uOey284AjD6N3dK62Y092b/9S71OR8dIIl0M6AMR7dbhmbRgKtb54:tSTjh+w4AjDS062BED9S+WqtAkdboFgx
TLSH
T183D533D677908474F00541BB7069B762DA1D7C388F3DCD1B62F9BD894AF429282C8ADB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5358992

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

out.upx

SHA256 887712bf6f1f5177947a08059a6c28960e073093f97be1d5a08c1775796f79a1
MD5 f7415b1fb15e396535e933e50f903a18
SHA1 4b0b9dac7fdde93de65eb9b1df8716581a48f03a
SHA512 99bda25b6355e8fb4f213960f57c2038e33691c73be666f4176171af4f971d44e5aba71f7fa9922dd491b30122aafeb0c1c988882ab680fee164e7e948e3ba30
SSDEEP 98304:CTq6666666666666666666666666666666x666666666666666fwwwwwwwwwwww5:kO5w7PabV33xFoTaxMNc9PDiEkAWLx4z
TLSH
T131367C02F1927031D9AF69B1FC7CAB661B29BD1A5BF184DB71C42C485FB02C07635B9A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

54332

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

269KB

Virtual Size

269KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

52KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.voltbl

Size

512B

Virtual Size

118B

Characteristics

Name

.rsrc

Size

4.7MB

Virtual Size

4.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

jaffacakes118_2e6cd039a1e738a1968fd27f6761809239606844e258e7e60d97ee19770513f2.bin

generic

out.upx

generic