8e896e933b7c468ece3bf60f0cc7eb96_JaffaCakes118 | Triage

Sharing

General

Target

8e896e933b7c468ece3bf60f0cc7eb96_JaffaCakes118
Size

852KB
MD5

8e896e933b7c468ece3bf60f0cc7eb96
SHA1

36355bb9d7bcca79b8a011c2ac25d421ef08f8c8
SHA256

d132d80e890cac383909153be14d62724afe5814f73a0fababd8309bfe63d6fa
SHA512

5971ad7dd53a422cb9c1bef7a09aea5d0dcf2390ee2e9b0604b0ba88f1739f917a7dc8394ac31b242ccbba7c5f0c48e1de00a3d1e199b3a4e437f69f46b22265
SSDEEP

24576:6NegAcowL/VWjTbA5FJEPAugsG1vMLNIEz27:6evwL/VWPbsFuYuH8EqEm

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
8e896e933b7c468ece3bf60f0cc7eb96_JaffaCakes118
unpack001/out.upx

Files

8e896e933b7c468ece3bf60f0cc7eb96_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 444KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 851KB - Virtual size: 852KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 124KB - Virtual size: 121KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE