fb2dcc045afd144b1b743efbed7b60ce_JaffaCakes118 | Triage

Sharing

General

Target

fb2dcc045afd144b1b743efbed7b60ce_JaffaCakes118
Size

17KB
MD5

fb2dcc045afd144b1b743efbed7b60ce
SHA1

b0eb38604c9e5065f10cf35ffc8b88899c054567
SHA256

4c5d464d2636c4e155fa51be824cbf2038824683c7778738d59dee5a2cd8ab69
SHA512

3e025b8132d6457084c57267d08722c9945ec7bab4d336b9d62c23986fe104f28dcc133023b9fd7629100ae76a8b636369a2ab02cc5cf030af0beee12d9b3086
SSDEEP

384:GtBXPIffR9PaRGeRcm+WiPMDQ2Q8+Wdvm8Gzg10jds:0x+vaNcXPcd+8ugyR

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
fb2dcc045afd144b1b743efbed7b60ce_JaffaCakes118
unpack001/out.upx

Files

fb2dcc045afd144b1b743efbed7b60ce_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 44KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 15KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe .vbs windows:4 windows x86 arch:x86 polyglot

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.data
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ