0a26335b270c48153c7ba8829a1fbac3_JaffaCakes118

General

Target

0a26335b270c48153c7ba8829a1fbac3_JaffaCakes118
Size

152KB
MD5

0a26335b270c48153c7ba8829a1fbac3
SHA1

315632e45783c61bfbe6e8f208c59be9cb5326fa
SHA256

20dd4587c98b48c98ad0fa44f6c2de5cc54646e847b921ecb5822489570849b2
SHA512

b81c9762598b02da499435e1b8b2574a8213b1bfe32ff99b951f8b752b28c9186f5cbd7c14e426a2ef1d53a25745725dab7794b78df65fb03abbe3b20d2b0863
SSDEEP

3072:gB+f6+VRXae+wc20k4IRJLFOyTAUzp7CgExCf2hS5G0FKRAHWcQvw:koKe+wcE4IPd77CgExRhYz0RAHZD

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0a26335b270c48153c7ba8829a1fbac3_JaffaCakes118

Files

0a26335b270c48153c7ba8829a1fbac3_JaffaCakes118
.exe windows:6 windows x86 arch:x86

27aa6d4ea11da145e661917334c22657

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

ctfmon.pdb

Imports

kernel32

RegisterApplicationRestart
GetModuleHandleW
GetCommandLineW
GetStartupInfoW
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoA
InterlockedCompareExchange
Sleep
InterlockedExchange

msvcrt

_controlfp
_except_handler4_common
?terminate@@YAXXZ
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_amsg_exit
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs

msctfmonitor

DoMsCtfMonitor

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 904B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 412B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

UPX0
Size: 144KB - Virtual size: 380KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

27aa6d4ea11da145e661917334c22657

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

msvcrt

msctfmonitor

Sections

.text Size: 3KB - Virtual size: 3KB

.data Size: 512B - Virtual size: 904B

.rsrc Size: 3KB - Virtual size: 2KB

.reloc Size: 512B - Virtual size: 412B

UPX0 Size: 144KB - Virtual size: 380KB

.text
Size: 3KB - Virtual size: 3KB

.data
Size: 512B - Virtual size: 904B

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 512B - Virtual size: 412B

UPX0
Size: 144KB - Virtual size: 380KB