939b887df997ef60ce42c6c0a44becbb_JaffaCakes118 | Triage

Sharing

General

Target

939b887df997ef60ce42c6c0a44becbb_JaffaCakes118
Size

187KB
MD5

939b887df997ef60ce42c6c0a44becbb
SHA1

987bbea65f8dc5be8c856d4379143de69b0c87bb
SHA256

0c90e298eefed817fe94025f21fadb94db9cd6a0a20a3fdf3b962bdceca9ec15
SHA512

00772928eb04513f88281203532c1fce15ad66771a7cb1326fc00a78d2f1ce29b3043e0628b2e79f0f9a5f515c174d914e8cea56bc59689c82831e43b49d6c71
SSDEEP

3072:gba6u7UOGq39/PN9TqzX16T4C64YBwAvAB+D+HX5FGODHhlC+XVi1o:n6u4Vq3QDkKFOAvAMD+35HTFXU1

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
939b887df997ef60ce42c6c0a44becbb_JaffaCakes118
unpack001/out.upx

Files

939b887df997ef60ce42c6c0a44becbb_JaffaCakes118
.exe windows:5 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 48KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 161KB - Virtual size: 164KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 25KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:5 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 134KB - Virtual size: 133KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ