67494464405a35fe8f1ab5a364a6a85d_JaffaCakes118 | Triage

Sharing

General

Target

67494464405a35fe8f1ab5a364a6a85d_JaffaCakes118
Size

89KB
MD5

67494464405a35fe8f1ab5a364a6a85d
SHA1

e001f5bd4815271d684f556380ca6158795baa31
SHA256

dc04cd60b2d16477a6a9f411895d69622bd064f0f523c4b5fe8422d055962db7
SHA512

2847ccddcbe9741cdfca914903fd4f5829c2f7351508b10b10327fe4ca487a7b1759d6be3bfbba0b0ec213044b8fc003d5320d3aa3a14f979597b169a07fabe7
SSDEEP

1536:PL1SV2InQgiiIIWnbnemzkjPFPQmAuAb8j9QJ3VndvAsbzqC8G7tVL/f+rvn/dzH:PLEugiiTinemzktQ3b+9QJdd5beC8EJe

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
static1/unpack001/FarPoint.Spread.for.Web.Forms.VS2005.v3.0.2003.Incl.Keygen-ORiON/Keygen.exe	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/FarPoint.Spread.for.Web.Forms.VS2005.v3.0.2003.Incl.Keygen-ORiON/Keygen.exe
unpack002/out.upx

Files

67494464405a35fe8f1ab5a364a6a85d_JaffaCakes118
.zip
FarPoint.Spread.for.Web.Forms.VS2005.v3.0.2003.Incl.Keygen-ORiON/Keygen.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 140KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 82KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 76KB - Virtual size: 74KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
FarPoint.Spread.for.Web.Forms.VS2005.v3.0.2003.Incl.Keygen-ORiON/file_id.diz
FarPoint.Spread.for.Web.Forms.VS2005.v3.0.2003.Incl.Keygen-ORiON/orion.nfo
keygen.nfo