2e2ae0904b2c08af497b2f83b4402663_JaffaCakes118 | Triage

Sharing

General

Target

2e2ae0904b2c08af497b2f83b4402663_JaffaCakes118
Size

381KB
MD5

2e2ae0904b2c08af497b2f83b4402663
SHA1

b97df0422b10ae1faf1d7f1962d9e49fab707b83
SHA256

7fff4a8c2bc51d300af7c453fb013277282569e3320f58281061a2c4430905cf
SHA512

79227bb4d6c6f55531919df31ffcc0d8f6d7f680fe6da68931b8124ff48e7a95313ae206afa42f82eccc37ec07fc7dfd90c636561abd075509b898d0b312f6ba
SSDEEP

6144:q4Ih6FDaf11usQnu7bc6WsSbPaxPAmV5D8j/dQm6qZ6u1EdY9huCba+VieAb6kt:OhwfuXLWlP+f3DqpEHa98lUiep

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
2e2ae0904b2c08af497b2f83b4402663_JaffaCakes118
unpack001/out.upx

Files

2e2ae0904b2c08af497b2f83b4402663_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 412KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 380KB - Virtual size: 384KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 777KB - Virtual size: 777KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE