67b065798bed9d0a2a124ee697096179_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

67b065798bed9d0a2a124ee697096179_JaffaCakes118
Size

19KB
MD5

67b065798bed9d0a2a124ee697096179
SHA1

501202c07770d3473a5d1c49146f65b5be87d3af
SHA256

2b8503ce71ac6ee9c800f5237321e6845001a2c9a9aec51c7f1e555f324cbdc4
SHA512

d1601458422ca78884a1c368e7195ff135869e36a7a8fd8a1c6eb4e9e1e33be3e270a6f51f56d703ec50580f7fd61de986fdb1d523fc1774a093617943f50017
SSDEEP

384:akfHBCYPriGxV1mPs5EHFqeA5vQsMD26dfiCaJ0xRrxjkY:NPriGxVWseQvbYddfiCaeFj

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
67b065798bed9d0a2a124ee697096179_JaffaCakes118
unpack001/out.upx

Files

67b065798bed9d0a2a124ee697096179_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 372KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 18KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 19KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 356KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ