1affe608abb5dea1a43d6b0c8058b592_JaffaCakes118 | Triage

Sharing

General

Target

1affe608abb5dea1a43d6b0c8058b592_JaffaCakes118
Size

91KB
MD5

1affe608abb5dea1a43d6b0c8058b592
SHA1

baed3d055484d3d37ebe43d89c5ab0ba9dec94f7
SHA256

efcdeb88b6558cb66a59bff97a92a680f9379864298c9cebac8f282106e6e5c9
SHA512

82ff5857368733a706fad85f492fc766d5f5c574d57ed02eaf6a8484bf7d6f0b8a5054be285903dc3647fcf6e2b881fe9db8658148d9d321c30b8225fcb5f46d
SSDEEP

1536:pFp1P1H1kmaFhWBSeZCxZa00fbgCg/XiAdmiSQ3J4vkyCfv6Voxs16cB6C:F1V1zWhWBzWZanftgfiKmiJHlfv6D1HD

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
1affe608abb5dea1a43d6b0c8058b592_JaffaCakes118
unpack001/out.upx

Files

1affe608abb5dea1a43d6b0c8058b592_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 176KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 90KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 180KB - Virtual size: 178KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE