1821d5d1371f9a2e0296d8e1f59506f7_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1821d5d1371f9a2e0296d8e1f59506f7_JaffaCakes118
Size

91KB
MD5

1821d5d1371f9a2e0296d8e1f59506f7
SHA1

00c1cddf07832f03e04218845139f6f53b4e8b11
SHA256

0e542eefc251de47619bd2adb605d0c85d21fc27cdeea4138cb5f1a2a4a72b03
SHA512

1ed41322dae6656cfd4c08af03655b3696d65d03318f91592bf816f340b1ab7c0d3bc488899de54042751b86d956b98b7b1bb504bdb4714c95c801da1cba8898
SSDEEP

1536:bt4YazDaPxeYv+PTJWruXSoKmn+200c4d80Pgo8DDsy2QjJSi:xDanU+PTJWrfmn+2wQ8mf8DDs+J

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
1821d5d1371f9a2e0296d8e1f59506f7_JaffaCakes118
unpack001/out.upx

Files

1821d5d1371f9a2e0296d8e1f59506f7_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 176KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 89KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 180KB - Virtual size: 178KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE