8ed6e23731912c9a1da25223422487b3_JaffaCakes118 | Triage

Sharing

General

Target

8ed6e23731912c9a1da25223422487b3_JaffaCakes118
Size

12KB
MD5

8ed6e23731912c9a1da25223422487b3
SHA1

470f11bebf37a1c67d8bb6714d1cce39f8bea9ac
SHA256

ca66fe4f11d4ce764f9348bea9ebde18a57f9da928fe381d434a9de2882d1bb1
SHA512

27285e344d0a22ed7fd6360dee77ecc19c82a0f2458897f5e755b33a237bdb1608e1ee71bcbbdee8195f88deb2e79936802ee9b3fa6359cb00c41a7cb8031a4f
SSDEEP

192:fkMn6t/yKW/EfF4cPOKSvY+AD8sOpDhoYDWyOkIbqwx+tlXrPw87:2yKW/OF4s+v+8soyoWRrF+bbd7

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
8ed6e23731912c9a1da25223422487b3_JaffaCakes118
unpack001/out.upx

Files

8ed6e23731912c9a1da25223422487b3_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 424KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 10KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 402KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE