49b9be7bcd5826cad36d7dfc9b05dedc_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

49b9be7bcd5826cad36d7dfc9b05dedc_JaffaCakes118
Size

215KB
MD5

49b9be7bcd5826cad36d7dfc9b05dedc
SHA1

910db1034de8624ea0b343154e050f2a8c598b41
SHA256

3c1a5e52202ca1a9f0f7f9d0775f5da7b4d82f4aeb69f1cbc6d06291018f3c24
SHA512

2842badc95ce29807b2899ee99df4346edd128ce88acbd2a7dd45b70250400e73e128c8fc133486e7e156472f9087f840bc7838822b8fc45cb56869391737648
SSDEEP

3072:f3aekzqhmrlWjVCr2iH3640AZO0hCmHTj5V0BydT1G/QvJzQqXlOMxmlSq+4:PaekGw8peasCaP5i2I/Q9nXl/uz

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
49b9be7bcd5826cad36d7dfc9b05dedc_JaffaCakes118
unpack001/out.upx

Files

49b9be7bcd5826cad36d7dfc9b05dedc_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 592KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 208KB - Virtual size: 208KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 780KB - Virtual size: 776KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ