84586bae971a1b8be07466dac237ebc2_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

84586bae971a1b8be07466dac237ebc2_JaffaCakes118
Size

20KB
MD5

84586bae971a1b8be07466dac237ebc2
SHA1

e39c242d264f3080d6fd46cf1d8773ae2d13d4a0
SHA256

1b2a81c1c93cb7f33e8142c1de6124814ec85467f2997c6abcbfb726c91932c3
SHA512

0a2975fbae1dec7252c0ec1ac505edf67ef1432be7c1287cbb3312be5828de1dfbe905384eaa1fcaee7afb1cd4a7fb04990a2be41c5f03f559a280fb31002d70
SSDEEP

384:+3ZJEw8mQw7rxkYfwSGmfSh9+dgYtCe/toJ91VA2TWplg43PdG0LdfiLD:6Zx8YGYfcmfhqRe/to8g2PdG0Lt0

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
84586bae971a1b8be07466dac237ebc2_JaffaCakes118
unpack001/out.upx

Files

84586bae971a1b8be07466dac237ebc2_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 36KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 32KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ