6016477a96fd9762fd7f6f33b6097a13_JaffaCakes118 | Triage

Sharing

General

Target

6016477a96fd9762fd7f6f33b6097a13_JaffaCakes118
Size

409KB
MD5

6016477a96fd9762fd7f6f33b6097a13
SHA1

8f8baf87ae8c15fcd6f6eb83a0461a6be171f15e
SHA256

42abe8d862cc51b6353d1bd5124ad3b288bab75ee28d34353fc99b70f7e3b941
SHA512

2b1438c4616254762842586bc45a1e18bcf4d4c2d86cd3bec792be115ccb65bf05cd3387443351e944478a6675bc12917e0d7505e20f437c614bf904c5f9cec1
SSDEEP

12288:D4uoXLAAuseZGoL/rgL4Mzxuyqu97YmQcVSPwUES0:nXseZGO/rPcuyquymQcVSPwdX

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
6016477a96fd9762fd7f6f33b6097a13_JaffaCakes118
unpack001/out.upx

Files

6016477a96fd9762fd7f6f33b6097a13_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 608KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 407KB - Virtual size: 408KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 732KB - Virtual size: 730KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 184KB - Virtual size: 181KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 64KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ