6a9538774aa3c4de807ba9f2e28f1b3c_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

6a9538774aa3c4de807ba9f2e28f1b3c_JaffaCakes118
Size

653KB
MD5

6a9538774aa3c4de807ba9f2e28f1b3c
SHA1

076caf0a80f3dc68019d31c4045d5d931b3eb2b8
SHA256

23dfdc1de74aadf66c29803adde573c991e69f159b4ec8fbca7c575a377d71e7
SHA512

5c7771c4920695779f47e5f35c76d40d291366f28e2c4e4f81ed53b06b22f81c8b0bef324053c72aa7e775a9ddd322c457cb7bb6e7398555e240f68499425adb
SSDEEP

12288:B/u/3C9a9MOzTvxr1SAif1u6Co+GGqclaCv6zUgPzruUmua59eZN9hDa9Sh:B/83v9M+F1nqE/IclCIMekZ3d2Sh

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
6a9538774aa3c4de807ba9f2e28f1b3c_JaffaCakes118
unpack001/out.upx

Files

6a9538774aa3c4de807ba9f2e28f1b3c_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 732KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 647KB - Virtual size: 648KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ