e817412436d335aa94835de4ad2fc357_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

e817412436d335aa94835de4ad2fc357_JaffaCakes118
Size

288KB
MD5

e817412436d335aa94835de4ad2fc357
SHA1

959cd8bc53f54eaa44455dafae16f7ef57217212
SHA256

d00d2a4b57c9f0aa36fe03d1b7367f44465d2599b5297d36981d3acf16f27bb7
SHA512

51e11ced371c56c327f803bb2ebbe9ab618035b3317615f8af51652770e3c3f21a741ef1aed6ac1cd85bc5185259496dfaeca2496848c6d906a2471fb6e03846
SSDEEP

6144:zFlK7BXzHgjDRT4wVuK11sFEwBpkLSm+luSk6XqLb+KV/YF+qtEXCrYW:zFUSjD/uK11g9kF/6XqLb+KdYjtiip

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
e817412436d335aa94835de4ad2fc357_JaffaCakes118
unpack001/out.upx

Files

e817412436d335aa94835de4ad2fc357_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 32KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 21KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ