1bb9e49f7638d7808cf56d6a1a8bfaef_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1bb9e49f7638d7808cf56d6a1a8bfaef_JaffaCakes118
Size

383KB
MD5

1bb9e49f7638d7808cf56d6a1a8bfaef
SHA1

77d28c9f472b5a108d1be85a90132727cfb74338
SHA256

adaa0b8f8b52706530c6962bf8e2b102962c175fb9e5f71d657abf6e82e2bbbb
SHA512

a7def563885e19c79deaf4eadeea4f4b8b4d13c96502d33277565ab3a44467c4f1d77c7e50c8c6f7a3aabb550ee30e45c2b2e8b19f05badc8f841fb051c7e9e7
SSDEEP

6144:49k50NldggqBZUiPe4BQl/p4fcDU8Y/h88umy8x25JiIDRemM/q15pAthp:fWLdp8Ril/plY87KM5JT4v/q15mthp

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
1bb9e49f7638d7808cf56d6a1a8bfaef_JaffaCakes118
unpack001/out.upx

Files

1bb9e49f7638d7808cf56d6a1a8bfaef_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 432KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 380KB - Virtual size: 380KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 36KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 752KB - Virtual size: 754KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ