46a45119dfdf1c58ee12d0f7444188a3_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

46a45119dfdf1c58ee12d0f7444188a3_JaffaCakes118
Size

18KB
MD5

46a45119dfdf1c58ee12d0f7444188a3
SHA1

1e2fb5816c785b41c98c5ae199cf883129a0a7d6
SHA256

fbe05aa5df741204464108bb0b0d56284de5947f844d86db9bca654a2b1793aa
SHA512

486833fe757226c7433595d212eed4a96b56c34e5f14f2e91036e1645c3bbc1a1af4b1bff9ade0df460e82b55abc0b8f65f0054eae655a105cc6232edda068e3
SSDEEP

384:YPh5sJs879GZrb+QpyV20g4fnilETiwrkD9+KBUmcNC4Ojy:UR8kxb+QwQX4fi+Ti2kDE7mT1j

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
46a45119dfdf1c58ee12d0f7444188a3_JaffaCakes118
unpack001/out.upx

Files

46a45119dfdf1c58ee12d0f7444188a3_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 44KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 16KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 44KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ