3a1b26aa4df6d20f57f456b61d0bf712_JaffaCakes118 | Triage

Sharing

General

Target

3a1b26aa4df6d20f57f456b61d0bf712_JaffaCakes118
Size

464KB
MD5

3a1b26aa4df6d20f57f456b61d0bf712
SHA1

f6c1f1bc4a765f6d00e25d18d611811f879363d1
SHA256

fc11beb65684e531409f3e4f075e6093dee06e0d381d7bcc6ff6cb8bf8b94666
SHA512

0b54db3530eac301ff0a3b69121c7457179ce815ac9543c4e457d1d84b3bd96391f0e78a0f3aec31841abd639c8d830ebd9b3630fc60a52dedb3631d977e113f
SSDEEP

12288:Z9FIaLZ0J5vMCAfw9YVoCeNMIWGOSe5S052xt16MD:Z9F7Z0Jtr9eeqsO7S056jV

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
3a1b26aa4df6d20f57f456b61d0bf712_JaffaCakes118
unpack001/out.upx

Files

3a1b26aa4df6d20f57f456b61d0bf712_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 848KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 437KB - Virtual size: 440KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 26KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ