290ea91861d9479f20a5fb52e47b02ec_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

290ea91861d9479f20a5fb52e47b02ec_JaffaCakes118
Size

401KB
MD5

290ea91861d9479f20a5fb52e47b02ec
SHA1

a4223ea2a340f53ef424dd287efe7d50a67d94d5
SHA256

5da8867953eddc97df5d66117e321770f11b2c7c3a6fe2142c3e1c6fc82cd176
SHA512

8553b3d70eddf2f7e65fd711922e8ea63e009cc2d0ef2262cc1d6a1828ce6f20a1586b7f678df88c3241eef5f68e271805558eefbee58dda55bdd0d46f708d0c
SSDEEP

12288:mwbd5aF3iJkcZMdCJGZVi8DDpjTADsEFyXopzRvKk:mIdc3iJk8mCOVi8DDpjTADFmo7Z

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
290ea91861d9479f20a5fb52e47b02ec_JaffaCakes118
unpack001/out.upx

Files

290ea91861d9479f20a5fb52e47b02ec_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 128KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 386KB - Virtual size: 388KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 44KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 444KB - Virtual size: 440KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ