2319426fa04abe9b42201f64a2167efb_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

2319426fa04abe9b42201f64a2167efb_JaffaCakes118
Size

1.5MB
MD5

2319426fa04abe9b42201f64a2167efb
SHA1

39a52f61302fa8e6f3446fbd93c28116d5ff74be
SHA256

40d1c929a3e48703f24e1fece0e78fe3a224eaf22cb36c5c9030b9d42cc39dce
SHA512

d8333fa9d9476ec61e1aaf9a1edde6f6c62e1ed120bf9f4bf29fd552bbe672011cc272ee7cf9d56c99ca192f9f3efacabadf071947f6c8341575f2e8e9c12828
SSDEEP

49152:M5dhpKOv4pp7Q4g2UV+6oaswLQvGOq/Jk:M5dDpv4ptXgJbss56

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
2319426fa04abe9b42201f64a2167efb_JaffaCakes118
unpack001/out.upx

Files

2319426fa04abe9b42201f64a2167efb_JaffaCakes118
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 3.2MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 139KB - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Exports

Exports

??$MakeCheckOpValueString@C@google@@YAXPAV?$basic_ostream@DU?$char_traits@D@std@@@std@@ABC@Z
??$MakeCheckOpValueString@D@google@@YAXPAV?$basic_ostream@DU?$char_traits@D@std@@@std@@ABD@Z
??$MakeCheckOpValueString@E@google@@YAXPAV?$basic_ostream@DU?$char_traits@D@std@@@std@@ABE@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@W4_Uninitialized@1@_N@Z
??0CheckOpMessageBuilder@base@google@@QAE@PBD@Z
??0ErrnoLogMessage@google@@QAE@PBDHHHP8LogMessage@1@AEXXZ@Z
??0LogMessage@google@@QAE@PBDH@Z
??0LogMessage@google@@QAE@PBDHABUCheckOpString@1@@Z
??0LogMessage@google@@QAE@PBDHH@Z
??0LogMessage@google@@QAE@PBDHHHP801@AEXXZ@Z
??0LogMessage@google@@QAE@PBDHHPAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??0LogMessage@google@@QAE@PBDHHPAV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@std@@@Z
??0LogMessage@google@@QAE@PBDHHPAVLogSink@1@_N@Z
??0LogMessageFatal@google@@QAE@PBDH@Z
??0LogMessageFatal@google@@QAE@PBDHABUCheckOpString@1@@Z
??0LogSink@google@@QAE@ABV01@@Z
??0LogSink@google@@QAE@XZ
??0LogStream@LogMessage@google@@QAE@PADHH@Z
??0Logger@base@google@@QAE@ABV012@@Z
??0Logger@base@google@@QAE@XZ
??0NullStream@google@@QAE@PBDHABUCheckOpString@1@@Z
??0NullStream@google@@QAE@XZ
??0NullStreamFatal@google@@QAE@PBDHABUCheckOpString@1@@Z
??0NullStreamFatal@google@@QAE@XZ
??1CheckOpMessageBuilder@base@google@@QAE@XZ
??1ErrnoLogMessage@google@@QAE@XZ
??1LogMessage@google@@QAE@XZ
??1LogMessageFatal@google@@QAE@XZ
??1LogSink@google@@UAE@XZ
??1LogStream@LogMessage@google@@UAE@XZ
??1Logger@base@google@@UAE@XZ
??1NullStream@google@@UAE@XZ
??1NullStreamFatal@google@@UAE@XZ
??4CheckOpMessageBuilder@base@google@@QAEAAV012@ABV012@@Z
??4LogMessageVoidify@google@@QAEAAV01@ABV01@@Z
??4LogSink@google@@QAEAAV01@ABV01@@Z
??4Logger@base@google@@QAEAAV012@ABV012@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@F@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@M@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@O@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV?$basic_ios@DU?$char_traits@D@std@@@1@AAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PBX@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_N@Z
??6google@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@std@@AAV12@ABW4PRIVATE_Counter@0@@Z
??_7LogSink@google@@6B@
??_7LogStream@LogMessage@google@@6B@
??_7Logger@base@google@@6B@
??_7NullStream@google@@6B@
??_7NullStreamFatal@google@@6B@
??_8LogStream@LogMessage@google@@7B@
??_8NullStream@google@@7B@
??_8NullStreamFatal@google@@7B@
??_DLogStream@LogMessage@google@@QAEXXZ
??_DNullStream@google@@QAEXXZ
??_DNullStreamFatal@google@@QAEXXZ
?AddLogSink@google@@YAXPAVLogSink@1@@Z
?CheckstrcasecmpfalseImpl@google@@YAPAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PBD00@Z
?CheckstrcasecmptrueImpl@google@@YAPAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PBD00@Z
?CheckstrcmpfalseImpl@google@@YAPAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PBD00@Z
?CheckstrcmptrueImpl@google@@YAPAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PBD00@Z
?FLAGS_alsologtoemail@fLS@@3AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@A
?FLAGS_alsologtostderr@fLB@@3_NA
?FLAGS_colorlogtostderr@fLB@@3_NA
?FLAGS_log_backtrace_at@fLS@@3AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@A
?FLAGS_log_dir@fLS@@3AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@A
?FLAGS_log_link@fLS@@3AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@A
?FLAGS_log_prefix@fLB@@3_NA
?FLAGS_logbuflevel@fLI@@3HA
?FLAGS_logbufsecs@fLI@@3HA
?FLAGS_logemaillevel@fLI@@3HA
?FLAGS_logmailer@fLS@@3AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@A
?FLAGS_logtostderr@fLB@@3_NA
?FLAGS_max_log_size@fLI@@3HA
?FLAGS_minloglevel@fLI@@3HA
?FLAGS_stderrthreshold@fLI@@3HA
?FLAGS_stop_logging_if_full_disk@fLB@@3_NA
?FLAGS_v@fLI@@3HA
?FLAGS_vmodule@fLS@@3AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@A
?Fail@LogMessage@google@@SAXXZ
?Flush@LogMessage@google@@QAEXXZ
?FlushLogFiles@google@@YAXH@Z
?FlushLogFilesUnsafe@google@@YAXH@Z
?ForVar1@CheckOpMessageBuilder@base@google@@QAEPAV?$basic_ostream@DU?$char_traits@D@std@@@std@@XZ
?ForVar2@CheckOpMessageBuilder@base@google@@QAEPAV?$basic_ostream@DU?$char_traits@D@std@@@std@@XZ
?GetExistingTempDirectories@google@@YAXPAV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@std@@@Z
?GetLogSeverityName@google@@YAPBDH@Z
?GetLogger@base@google@@YAPAVLogger@12@H@Z
?GetLoggingDirectories@google@@YAABV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@std@@XZ
?Init@LogMessage@google@@AAEXPBDHHP812@AEXXZ@Z
?InitGoogleLogging@google@@YAXPBD@Z
?InitVLOG3__@google@@YA_NPAPAHPAHPBDH@Z
?InstallFailureFunction@google@@YAXP6AXXZ@Z
?LogSeverityNames@google@@3QBQBDB
?LogToStderr@google@@YAXXZ
?NewString@CheckOpMessageBuilder@base@google@@QAEPAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?RawLog__@google@@YAXHPBDH0ZZ
?RawLog__SetLastTime@google@@YAXABUtm@@H@Z
?RecordCrashReason@LogMessage@google@@AAEXPAUCrashReason@glog_internal_namespace_@2@@Z
?RemoveLogSink@google@@YAXPAVLogSink@1@@Z
?ReprintFatalMessage@google@@YAXXZ
?SafeFNMatch_@glog_internal_namespace_@google@@YA_NPBDI0I@Z
?SaveOrSendToLog@LogMessage@google@@AAEXXZ
?SendEmail@google@@YA_NPBD00@Z
?SendToLog@LogMessage@google@@QAEXXZ
?SendToSink@LogMessage@google@@AAEXXZ
?SendToSinkAndLog@LogMessage@google@@AAEXXZ
?SendToSyslogAndLog@LogMessage@google@@QAEXXZ
?SetEmailLogging@google@@YAXHPBD@Z
?SetLogDestination@google@@YAXHPBD@Z
?SetLogFilenameExtension@google@@YAXPBD@Z
?SetLogSymlink@google@@YAXHPBD@Z
?SetLogger@base@google@@YAXHPAVLogger@12@@Z
?SetStderrLogging@google@@YAXH@Z
?SetVLOGLevel@google@@YAHPBDH@Z
?ShutdownGoogleLogging@google@@YAXXZ
?ToString@LogSink@google@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@HPBDHPBUtm@@0I@Z
?TruncateLogFile@google@@YAXPBD_J1@Z
?TruncateStdoutStderr@google@@YAXXZ
?WaitTillSent@LogSink@google@@UAEXXZ
?WriteToStringAndLog@LogMessage@google@@AAEXXZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXI@Z
?copyfmt@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEAAV12@ABV12@@Z
?ctr@LogStream@LogMessage@google@@QBEHXZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEDD@Z
?g_logging_fail_func@google@@3P6AXXZA
?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QAE?AVlocale@2@ABV32@@Z
?kMaxLogMessageLen@LogMessage@google@@2IB
?narrow@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDDD@Z
?num_messages@LogMessage@google@@SA_JH@Z
?num_messages_@LogMessage@google@@0PA_JA
?opfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE_NXZ
?osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?pbase@LogStream@LogMessage@google@@QBEPADXZ
?pcount@LogStream@LogMessage@google@@QBEIXZ
?posix_strerror_r@google@@YAHHPADI@Z
?preserved_errno@LogMessage@google@@QBEHXZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@PAV32@@Z
?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@JH@Z
?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@H@2@@Z
?self@LogStream@LogMessage@google@@QBEPAV123@XZ
?set_ctr@LogStream@LogMessage@google@@QAEXH@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXI@Z
?str@LogStream@LogMessage@google@@QBEPADXZ
?stream@LogMessage@google@@QAEAAV?$basic_ostream@DU?$char_traits@D@std@@@std@@XZ
?stream@NullStream@google@@QAEAAV12@XZ
?tellp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@H@2@XZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@PAV32@@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBDH@Z

Sections

.text
Size: 2.8MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 627KB - Virtual size: 627KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 91KB - Virtual size: 778KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 147KB - Virtual size: 146KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 175KB - Virtual size: 174KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Headers

DLL Characteristics

File Characteristics

Sections

UPX0 Size: - Virtual size: 3.2MB

UPX1 Size: 1.4MB - Virtual size: 1.4MB

.rsrc Size: 139KB - Virtual size: 140KB

Headers

DLL Characteristics

File Characteristics

Exports

Exports

Sections

.text Size: 2.8MB - Virtual size: 2.8MB

.rdata Size: 627KB - Virtual size: 627KB

.data Size: 91KB - Virtual size: 778KB

.tls Size: 512B - Virtual size: 2B

.rsrc Size: 147KB - Virtual size: 146KB

.reloc Size: 175KB - Virtual size: 174KB

UPX0
Size: - Virtual size: 3.2MB

UPX1
Size: 1.4MB - Virtual size: 1.4MB

.rsrc
Size: 139KB - Virtual size: 140KB

.text
Size: 2.8MB - Virtual size: 2.8MB

.rdata
Size: 627KB - Virtual size: 627KB

.data
Size: 91KB - Virtual size: 778KB

.tls
Size: 512B - Virtual size: 2B

.rsrc
Size: 147KB - Virtual size: 146KB

.reloc
Size: 175KB - Virtual size: 174KB