2ca1e6197a559096397f5b1595a6fb33_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2ca1e6197a559096397f5b1595a6fb33_JaffaCakes118
Size

21KB
MD5

2ca1e6197a559096397f5b1595a6fb33
SHA1

dfe4d9b3f073f79c14783a33f8131c21ce54bb52
SHA256

210f164bb8f284e865a11dcfab29951a50b73e9407c66c674d377e252153e038
SHA512

f8ae1c668674332b5682c76677cf8c862a9ebdbfedbde2c12c5e613b5012e583babdf3310bfc6eb47d06c8f4bce37f0c6af5eb4abc64f30c641aff199af4b95d
SSDEEP

384:hy1Ei7OXOwRVdIevXQO7+beIrB7x+UDapPNalfLKPhQW6FWmp:efuRVqeQkZqBR+m25G

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
2ca1e6197a559096397f5b1595a6fb33_JaffaCakes118
unpack001/out.upx

Files

2ca1e6197a559096397f5b1595a6fb33_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 44KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 17KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 48KB - Virtual size: 46KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ