fe449fcb5e1fb6d57fb52cfd8f7100f1_JaffaCakes118 | Triage

Sharing

General

Target

fe449fcb5e1fb6d57fb52cfd8f7100f1_JaffaCakes118
Size

9KB
MD5

fe449fcb5e1fb6d57fb52cfd8f7100f1
SHA1

c15c7a7d48362cbacb88ca9304956e0930f3f057
SHA256

8a5cacdd6bf0d78b117f86caf9856f88b0a38b6bf79c6e9a85117d91d76e3c5b
SHA512

e0e5651e437a55c9dde2203f8586b7f93e3c933b80a4eadd37f3f706866ed448817792477cff059166ad8ee9f45ad29865affcb1ced04ecde61451c4abe33ebc
SSDEEP

192:GYE8fuG4Jl/wOi/Bx+l9wMC0qZ1Jc862MhdZD/:GYEBj4x+Xwz0qZ1i86TdZD

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
fe449fcb5e1fb6d57fb52cfd8f7100f1_JaffaCakes118
unpack001/out.upx

Files

fe449fcb5e1fb6d57fb52cfd8f7100f1_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 24KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ