2ba0104ab2dfbb33ff4f847b4370943f_JaffaCakes118 | Triage

Sharing

General

Target

2ba0104ab2dfbb33ff4f847b4370943f_JaffaCakes118
Size

87KB
MD5

2ba0104ab2dfbb33ff4f847b4370943f
SHA1

6c8ca1b4672b81be1d884641dc23ccb788eab8b9
SHA256

bb0a8a9793cffef42a5cbeee61417776da9c0c1636df413f4e07abf580b049f9
SHA512

8bd387f4a63d40b82387f9ba600a8007b26cbc234ab9dbf37fef9410784ca43594e063c95e49e82812d070c90d1498fc1e268fd589070be3251598d1a25ad129
SSDEEP

1536:ZSXaBViPggHcDPWVnHf7zTylmcGnKiBCTyd4M5K6MSgUUS1mlmGzu+yMnEMr1h8R:ZcEaHcyFpbKi4y4kK6MSFUSaXzjyhAhC

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
2ba0104ab2dfbb33ff4f847b4370943f_JaffaCakes118
unpack001/out.upx

Files

2ba0104ab2dfbb33ff4f847b4370943f_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 120KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 85KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 164KB - Virtual size: 162KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE