3e9193e8f1e8f58389e35822e4030a36_JaffaCakes118 | Triage

Sharing

General

Target

3e9193e8f1e8f58389e35822e4030a36_JaffaCakes118
Size

78KB
MD5

3e9193e8f1e8f58389e35822e4030a36
SHA1

8915892be4ae2559dce5027dd2d9174e0d05a1d0
SHA256

303d4c88a5d7f8e950c017115166335598e63e6cefcc92e6fb3a8455be56e7d6
SHA512

411593352709acfbafe8fe870a711db93a20be837d6dcd8e76f6f961bd1614a99bb27abcd7d21debd4a647fe5aa68bfc80167107e0f3b26461142f3f7f1152f4
SSDEEP

1536:5GJ6k7TrpHOzjLXg5OeFcUH84e+XQTf1r4q/56YrnaNgnz9sjHY5p/6NYe6:5GgkrpuXDKFcM8+Xw8A6yj9sjc/6Nx6

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
3e9193e8f1e8f58389e35822e4030a36_JaffaCakes118
unpack001/out.upx

Files

3e9193e8f1e8f58389e35822e4030a36_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 124KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 74KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 72KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 112KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ