0b2d856f907c83a53ba008f9d33a1a98_JaffaCakes118 | Triage

Sharing

General

Target

0b2d856f907c83a53ba008f9d33a1a98_JaffaCakes118
Size

181KB
MD5

0b2d856f907c83a53ba008f9d33a1a98
SHA1

f10939620cae47dae3d5953a7e2e794346d337fe
SHA256

9983010483292b460cdc39f5128e5c673abf6c63ccce222b319bedf55978e03e
SHA512

defeaca04b41fbda04c90aeb9648998956b1da961234b530461c0b881d736b17d5ac22733b817c9a65afd28c7c20fc85812eaec0606ed1e9204e19b097166311
SSDEEP

3072:LXJgWeNgOkIP/MnePDDL05rg1MXcJDk2Tht7VB152/BqT9fvKNIhTsHJ7R/BAr/k:LXJhelLP/MeLDMg1VDxluqT9llC79mrc

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
static1/unpack002/CORE10k.EXE	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack002/CORE10k.EXE
unpack002/keygen.exe

Files

0b2d856f907c83a53ba008f9d33a1a98_JaffaCakes118
.rar
Personal.Knowbase.v3.2.1.Keymaker.Only-CORE/core.nfo
Personal.Knowbase.v3.2.1.Keymaker.Only-CORE/cr-pk321.zip
.zip
CORE.NFO
CORE10k.EXE
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 13.0MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 129KB - Virtual size: 132KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
FILE_ID.DIZ
keygen.exe
.exe windows:4 windows x86 arch:x86

09d0478591d4f788cb3e5ea416c25237

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

Sections

.data
Size: 36KB - Virtual size: 400KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Personal.Knowbase.v3.2.1.Keymaker.Only-CORE/file_id.diz