f895e84f82ccdb0adf8cc0898f7292f2_JaffaCakes118 | Triage

Sharing

General

Target

f895e84f82ccdb0adf8cc0898f7292f2_JaffaCakes118
Size

10KB
MD5

f895e84f82ccdb0adf8cc0898f7292f2
SHA1

c12562a2331fa9a7357a332a66de331a774ea6c5
SHA256

d09fbbfcbd6e64fdfbd7ffbfed1a778d5067dc1e3f768efbcaf42ba6073020e2
SHA512

35fffa1ef94c3f2e5ca701c9b32a0d68ca6933f3a46286e39a6e390780875f43273ff2d30b911201da353eedf12b8975a627b46fe6836d4e14f2cb1841f6cdf6
SSDEEP

192:VnHfn5dj6HG5OPrcBc1Qf1QTOIn5dxwwTPO:VnP5dOGUAiWe5zVW

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f895e84f82ccdb0adf8cc0898f7292f2_JaffaCakes118

Files

f895e84f82ccdb0adf8cc0898f7292f2_JaffaCakes118
.exe windows:4 windows x86 arch:x86

d913c6e7038835911af040c4e7e9a9ca

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Process32First
GetFileAttributesA
GetLastError
GetProcessHeap
HeapAlloc
GetCommandLineA
GetStartupInfoA
CloseHandle
WriteFile
CreateFileA
CreateProcessA
Process32Next
WaitForSingleObject
TerminateProcess
OpenProcess
GetShortPathNameA
lstrcmpiA
CreateToolhelp32Snapshot
Sleep
DeleteFileA
GetSystemDirectoryA
GetWindowsDirectoryA
FreeLibrary
LoadLibraryA
GetProcAddress
GetModuleHandleA
ExitProcess

comdlg32

GetFileTitleA

urlmon

ObtainUserAgentString

wininet

InternetReadFile
InternetOpenA
InternetOpenUrlA
InternetCloseHandle

Sections

UPX0
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.avp
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE