2c081eb1f8bae2f6f38532a9cbc7e257_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2c081eb1f8bae2f6f38532a9cbc7e257_JaffaCakes118
Size

48KB
MD5

2c081eb1f8bae2f6f38532a9cbc7e257
SHA1

8a8a27c258313935f2e1493eab07ff11ae833e1f
SHA256

40c8221b2e8a862cee01a1e8ac1a32f40fc58d35d31a5f2b7e892fc897913850
SHA512

4a112756ad8d94ce1dc4d311c8871a01da1b702cee972a511d8b33b31325a4dd82e04a8d445cbede36726d918befd0cec202c63a51c3bc78c9c3ddf0a31ae074
SSDEEP

768:JSJgne5sxtRBaNhUZm1Y8zRVSADhCOlCCNTbxQkVEspZspKVWByJPE:JS7sxup1YI/S2hbBNTbxQw7hVWByE

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
2c081eb1f8bae2f6f38532a9cbc7e257_JaffaCakes118
unpack001/out.upx

Files

2c081eb1f8bae2f6f38532a9cbc7e257_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 40KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 18KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 29KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ