26a0054b2a1ddc9b6ab3a787becc144e_JaffaCakes118 | Triage

Sharing

General

Target

26a0054b2a1ddc9b6ab3a787becc144e_JaffaCakes118
Size

12KB
MD5

26a0054b2a1ddc9b6ab3a787becc144e
SHA1

b0c4e934f22b4816303bf874de7911b4958259ba
SHA256

9698bbc14768a2a212a4e1353e24d4b3ab027d3e32c95ffc7135d8469724c7f9
SHA512

98724618bd2e83094e1aa08d71dd3cfe010927450682eb7296d61ac7b3be174dad7f1ad9c69d25ffbac7b21bb2ef60ced59818664b9f07483b7dc149e4ef7b34
SSDEEP

192:eR7BSMx15w3q58YYw73dIAVnmZl4pGNzkhYcrUHsUR+oIfKnd9+AwlXaeJI8o:eJn8YJv9zzIHJR+NfCd9+Aw93

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
26a0054b2a1ddc9b6ab3a787becc144e_JaffaCakes118
unpack001/out.upx

Files

26a0054b2a1ddc9b6ab3a787becc144e_JaffaCakes118
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

UPX0
Size: - Virtual size: 32KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 10KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.data
Size: 17KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ