jaffacakes118_048a55c8b67f34582bf02a2cd997e849c0821c4f2cdde78d1cbcaab7d0bc9f4f[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_048a55c8b67f34582bf02a2cd997e849c0821c4f2cdde78d1cbcaab7d0bc9f4f.bin
Size 2.7MB
Sample261018-t2s19aez3j
SHA256 048a55c8b67f34582bf02a2cd997e849c0821c4f2cdde78d1cbcaab7d0bc9f4f
MD5 c44c72ed30d24ff567f4d469a69bb1d6
SHA1 f30d007337422c6b1519e449636a6ab023bf83b2
SHA512 0a01f0593f07b296fef21610bef58b70fa5aed9d6b80bd3262a9a226c4a662a666bec77c99aff260027fb0bb9de51f495fe45c5293cbbc0d7f6e4ffde01c1553
SSDEEP 49152:cu1+/STj7r5uOey284AjD6N3dK62Y092b/9S71OR8dIIl0M6AMR7dbhmbRgKtb53:4STjh+w4AjDS062BED9S+WqtAkdboFga
TLSH
T12DD533D677908874F00541BB7069B762DA1D7C388F3DCD1B62F9BD894AF419282C8ADB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_048a55c8b67f34582bf02a2cd997e849c0821c4f2cdde78d1cbcaab7d0bc9f4f.bin
unpack001/out.upx

File Explorer

jaffacakes118_048a55c8b67f34582bf02a2cd997e849c0821c4f2cdde78d1cbcaab7d0bc9f4f.bin

.exe 2.7MB
out.upx

.exe 5.1MB

jaffacakes118_048a55c8b67f34582bf02a2cd997e849c0821c4f2cdde78d1cbcaab7d0bc9f4f.bin

SHA256 048a55c8b67f34582bf02a2cd997e849c0821c4f2cdde78d1cbcaab7d0bc9f4f
MD5 c44c72ed30d24ff567f4d469a69bb1d6
SHA1 f30d007337422c6b1519e449636a6ab023bf83b2
SHA512 0a01f0593f07b296fef21610bef58b70fa5aed9d6b80bd3262a9a226c4a662a666bec77c99aff260027fb0bb9de51f495fe45c5293cbbc0d7f6e4ffde01c1553
SSDEEP 49152:cu1+/STj7r5uOey284AjD6N3dK62Y092b/9S71OR8dIIl0M6AMR7dbhmbRgKtb53:4STjh+w4AjDS062BED9S+WqtAkdboFga
TLSH
T12DD533D677908874F00541BB7069B762DA1D7C388F3DCD1B62F9BD894AF419282C8ADB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5358992

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

out.upx

SHA256 887712bf6f1f5177947a08059a6c28960e073093f97be1d5a08c1775796f79a1
MD5 f7415b1fb15e396535e933e50f903a18
SHA1 4b0b9dac7fdde93de65eb9b1df8716581a48f03a
SHA512 99bda25b6355e8fb4f213960f57c2038e33691c73be666f4176171af4f971d44e5aba71f7fa9922dd491b30122aafeb0c1c988882ab680fee164e7e948e3ba30
SSDEEP 98304:CTq6666666666666666666666666666666x666666666666666fwwwwwwwwwwww5:kO5w7PabV33xFoTaxMNc9PDiEkAWLx4z
TLSH
T131367C02F1927031D9AF69B1FC7CAB661B29BD1A5BF184DB71C42C485FB02C07635B9A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

54332

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

269KB

Virtual Size

269KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

52KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.voltbl

Size

512B

Virtual Size

118B

Characteristics

Name

.rsrc

Size

4.7MB

Virtual Size

4.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

jaffacakes118_048a55c8b67f34582bf02a2cd997e849c0821c4f2cdde78d1cbcaab7d0bc9f4f.bin

generic

out.upx

generic