8ec2d81d753ece926f4cf542ea163262_JaffaCakes118 | Triage

Sharing

General

Target

8ec2d81d753ece926f4cf542ea163262_JaffaCakes118
Size

273KB
MD5

8ec2d81d753ece926f4cf542ea163262
SHA1

f525bcc4c3f55bc4a0370ffce4672cfd09c8e510
SHA256

c8f25e09e8468322083e694c25fd4fc75aba52fe28db1189e9434c782e1bd409
SHA512

0b0ee665082e8dbeb878c35d5396bbb84266f2994eb2f83c2cb7adc1d7eaf35cc689cafcb93de4d955339352c2478d9527dcdf8c0d39cb52f4205bad544c61b7
SSDEEP

6144:/h5kQ1fzQzxsO6Tx9UYPSYAMMMMMMMMMMMMMMMMMMjtdcEC6a8IfNmFMMMMMMMME:/zkyfzQFsrTx9U0SYAMMMMMMMMMMMMMn

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
8ec2d81d753ece926f4cf542ea163262_JaffaCakes118
unpack001/out.upx

Files

8ec2d81d753ece926f4cf542ea163262_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 444KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 161KB - Virtual size: 164KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 111KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 484KB - Virtual size: 481KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 112KB - Virtual size: 110KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ