1ba0d4d47428f3818093a81c8ba4cbd6_JaffaCakes118 | Triage

Sharing

General

Target

1ba0d4d47428f3818093a81c8ba4cbd6_JaffaCakes118
Size

84KB
MD5

1ba0d4d47428f3818093a81c8ba4cbd6
SHA1

4838c7ce64ff42a9558d023d579dd2b5b1dc109a
SHA256

cf9bb3a6ed055d00467c8d767f02cd0e903ca427d1b751a56bb8cac01bdbf227
SHA512

85de71ab723d376848d8b634bb7b0180324b359a64e11e1a9bf5fd4c08f920dc920567dbfba67ea41b19d7e6b2b77ee3f00f0e52608ac49686c671e2f5f01699
SSDEEP

1536:vKxZdumDSmvH1c4iDrRMFAYPqFemoJCzV5G3DjrMQ7jEuWG1aeYENa3IwVDrM3:vKdum+uH1XDgemFvODE84FvSNaYwVrk

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
1ba0d4d47428f3818093a81c8ba4cbd6_JaffaCakes118
unpack001/out.upx

Files

1ba0d4d47428f3818093a81c8ba4cbd6_JaffaCakes118
.exe windows:5 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 28KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 76KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:5 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 49KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ