ed3ac876feb064adc294c5e4c054dfa4_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ed3ac876feb064adc294c5e4c054dfa4_JaffaCakes118
Size

75KB
MD5

ed3ac876feb064adc294c5e4c054dfa4
SHA1

62ed23857bab11abd0e01af602abc209a6ed1d1b
SHA256

245184ea442fccf8aa4c61e1fe348d00d0884bafc80f25d674770d1a04be9de0
SHA512

d773107b81a41711a0042604f89406dddc4283b895e23e666be11112fe450d68a29b3b4a968807855dd7ce64bdedfb17d0b1f4af7c819c204343a2a177498b6b
SSDEEP

1536:B53NrldwDbs7EgRL7XTdlx7kMbLqF2xMvZ9ePqBKHfE9bgP42Vop8/eJ:BNNPwDbEEC79IE2X1gVV68e

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
ed3ac876feb064adc294c5e4c054dfa4_JaffaCakes118
unpack001/out.upx

Files

ed3ac876feb064adc294c5e4c054dfa4_JaffaCakes118
.exe windows:9 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 116KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 72KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:9 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 512B - Virtual size: 46B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ