06054faad1c40babebac20fb1d3030df_JaffaCakes118 | Triage

Sharing

General

Target

06054faad1c40babebac20fb1d3030df_JaffaCakes118
Size

41KB
MD5

06054faad1c40babebac20fb1d3030df
SHA1

a9205e8bb5e3d75b2367d7b8ec2ece515436f60f
SHA256

b03a1fa3040d87a5a60973012bb4b5749de7d5f9a942db5cbc8d3ae14dbcdcf6
SHA512

d0b380445fec0c43a315f2c70023d183c1f7b33c437acaafea974a52caf1f838aab486676b287aad83b626eb50c100a7fb5cd40e1f176d0bbed4bb8e474b4c61
SSDEEP

768:GaXP161LpPQYXOw7qsFEG1QhouuczbkMmlPH/euRJIRyb9X0twHGmj0IlO:pd61LpPVMsFE0IouDbzS//H/5fbvO

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
06054faad1c40babebac20fb1d3030df_JaffaCakes118
unpack001/out.upx

Files

06054faad1c40babebac20fb1d3030df_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 68KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 13KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.bss
Size: - Virtual size: 46KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE