26240b90982fb6a6ae0568ee4a893862_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

26240b90982fb6a6ae0568ee4a893862_JaffaCakes118
Size

12KB
MD5

26240b90982fb6a6ae0568ee4a893862
SHA1

fc962c854869655158d6daf5086c1c6654916960
SHA256

54e43c8110d50b89b92476a96899e6733f33ac967473242edd74c9027b619f96
SHA512

666a3eeeb7c52712450c639d24b7ef69f25ff59df9336dc815a9a3f260d3e8157021f346c5532bfd9084731bfc0aae9d6608a0b471791b2d7fbf4a5d2ae7cf4f
SSDEEP

192:1q4wH8+jOvgwoPWJuZ8qrLxzTJlmtiiG8WdeumaQYOswSR8tVAD8aN:w45AOvgw/UZfJzTzxidUeudRhiWD8k

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
26240b90982fb6a6ae0568ee4a893862_JaffaCakes118
unpack001/out.upx

Files

26240b90982fb6a6ae0568ee4a893862_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 132KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 10KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.bss
Size: - Virtual size: 112KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE