8e27c1ac94071c342d11b189f9124581_JaffaCakes118 | Triage

Sharing

General

Target

8e27c1ac94071c342d11b189f9124581_JaffaCakes118
Size

419KB
MD5

8e27c1ac94071c342d11b189f9124581
SHA1

4d4d28419d49ada8701e05132d3b1ada2797a9d7
SHA256

c66317a2d686edc86ec0dfb9d54a33b944de93930f13e34f120b27ce36168113
SHA512

675bf92237d5492b9164a0dd899c124341a316019423e93f9976dafd69185825b43dd3176a9a9302497227736885a83a27ddb93edf1225321c166e3443c0e5f1
SSDEEP

6144:5uHOJrG1VVE+Iel+lXDZJfLufs73dOk0XDpNjNOpys8E/UOPSe570Szp3irG1VV8:gO9ureZJys73dOvXDpNjNe8TOB0JuV4

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
8e27c1ac94071c342d11b189f9124581_JaffaCakes118
unpack001/out.upx

Files

8e27c1ac94071c342d11b189f9124581_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 180KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 37KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 30KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 144KB - Virtual size: 143KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ