3b784d3adabf1c94b9fc2ebc47474bc0_JaffaCakes118 | Triage

Sharing

General

Target

3b784d3adabf1c94b9fc2ebc47474bc0_JaffaCakes118
Size

451KB
MD5

3b784d3adabf1c94b9fc2ebc47474bc0
SHA1

337c4e2b505172497f931b433fd83644b4fc6d3f
SHA256

82c8f0bcf7a8cff2f9a70a0a7d69b4cd45bb2f7336258836601f4efd14642b0e
SHA512

7954c824a584f11672278406c35527f89807036683feb9fcd31c3f49d0ed00ef559d4fba357977d71715b875f422968ea0f5dea8b582d2ab6a107bbdbeb9f16c
SSDEEP

12288:B2nlNKg8eSc31meqxsxytOEicQ2VkniYhEqfZFNT:BglkJc31mPsxytkJdnjCqfZFR

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
3b784d3adabf1c94b9fc2ebc47474bc0_JaffaCakes118
unpack001/out.upx

Files

3b784d3adabf1c94b9fc2ebc47474bc0_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 548KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 434KB - Virtual size: 436KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 724KB - Virtual size: 721KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 136KB - Virtual size: 133KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 76KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ