6203a7714974e98648ac8dc002a95432_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

6203a7714974e98648ac8dc002a95432_JaffaCakes118
Size

542KB
MD5

6203a7714974e98648ac8dc002a95432
SHA1

054a80a9d7fbd5d157f8ec29ad62bab06740d4fb
SHA256

20990cef52ae70e76be71ed5a29ec0f20881845ecfa1a0bd5bd77ea7b97173d3
SHA512

4ebf9e19fdfcca08a3742d00acc121c4df5b30584b2a372f4a9c89b23e592a97ef3a3dca8bc7edecbeb0be5fa6394e653c7654a36a8e4026cd1acd6af8f567ba
SSDEEP

12288:3mXvWyjdZ27G7L5/5eVwXJ9SjYN8jq9rUQHZeI7GJWGNFk:3mXvWy/27MdRGiJ9SjYO+9QGH73L

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
6203a7714974e98648ac8dc002a95432_JaffaCakes118
unpack001/out.upx

Files

6203a7714974e98648ac8dc002a95432_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 76KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 527KB - Virtual size: 528KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 14KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 80KB - Virtual size: 78KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 476KB - Virtual size: 474KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ