18b81e4c603f29fdf40b7a4688806a40_JaffaCakes118 | Triage

Sharing

General

Target

18b81e4c603f29fdf40b7a4688806a40_JaffaCakes118
Size

862KB
MD5

18b81e4c603f29fdf40b7a4688806a40
SHA1

959faec794d6b2c7864a054cbfb1b2f54edabdb6
SHA256

16fb1330590cfa09276ca02f243781b9a6e610c2ed5f80ad8ccc2bb8c8420a23
SHA512

be59779082bfb341e4e1bd9fc5a8aa7298507dfde4af11f1feaf8e9bb132c365dee73e8d349a0966d7d0ab17184cff2cd05ea66cf1eeeb6c37ade72f5f6f8e0c
SSDEEP

24576:XDUn7jHdsrksd4j28Dd+QI1JdUSmF+jRRCV:XDUnnEdNQI1JZjRR

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
18b81e4c603f29fdf40b7a4688806a40_JaffaCakes118
unpack001/out.upx

Files

18b81e4c603f29fdf40b7a4688806a40_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 2.0MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 761KB - Virtual size: 764KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 100KB - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 408KB - Virtual size: 406KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ