3ffd65239c7263e1cc91166b17eef822_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3ffd65239c7263e1cc91166b17eef822_JaffaCakes118
Size

422KB
MD5

3ffd65239c7263e1cc91166b17eef822
SHA1

58f0939bbc8d29e4bf9ace54618a3711e72f3425
SHA256

9a57b573cfb21d20dfad1e1d7f290f7686b84c3369a5631cb176cb34e91e0cf8
SHA512

85ffbaa65a6888d4192f1d8e6d1390daf7b93dde8ff8ea8b8e174985d1b01d9433cf524681578a3d4e677004f32d948bc63a9bc07d20d899a782ed4c2f4c21df
SSDEEP

6144:NS42KRxvqbei5kv6iKPYxoMe9jAb3GlLcOMDNY8lvAnNRSHq1VwSb5q8W/n5gYjO:AyRRGei5bkoMZTGloV1AnNUHCZQ8s

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
3ffd65239c7263e1cc91166b17eef822_JaffaCakes118
unpack001/out.upx

Files

3ffd65239c7263e1cc91166b17eef822_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 996KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 416KB - Virtual size: 420KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 224KB - Virtual size: 220KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ