fc4a5e5cc7812629dbb31ab6cfe3a2ad_JaffaCakes118 | Triage

Sharing

General

Target

fc4a5e5cc7812629dbb31ab6cfe3a2ad_JaffaCakes118
Size

690KB
MD5

fc4a5e5cc7812629dbb31ab6cfe3a2ad
SHA1

f243497873c355fed9ec384716f7706aa7a6e932
SHA256

e32f517ce13766831b776aa1e58aa1ce026a9059ba989c0e2f404a60564848b7
SHA512

3f815cf824f461792f2b1d62d516c01687017b60f6d2fdcce49bb6aa0994cf139acca2755651094663fa5363b4b6bafb47ba37d40ba392a0d3171a9b869e3faa
SSDEEP

12288:i0FPydNHeYY5/vXKUFPq5i/4i9PCI3TrUqdBvTjz+0Z:nF6+YY5/vXKUFPeW4YP3/HdBr3NZ

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

Processes:

resource
fc4a5e5cc7812629dbb31ab6cfe3a2ad_JaffaCakes118
unpack001/out.upx

Files

fc4a5e5cc7812629dbb31ab6cfe3a2ad_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 172KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 686KB - Virtual size: 688KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 180KB - Virtual size: 177KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 640KB - Virtual size: 638KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ