950e2160d4dc979bce4b69887e043b6d_JaffaCakes118 | Triage

Sharing

General

Target

950e2160d4dc979bce4b69887e043b6d_JaffaCakes118
Size

34KB
MD5

950e2160d4dc979bce4b69887e043b6d
SHA1

4fcbc247f6e0324ff53fd79f4551b08857448a66
SHA256

0f67ca41170604d1d3ad8f1908d2dc74abfb692db1c0f648fa44ac7e81670db4
SHA512

0d7a21baa62ff99e72c6f201fabfcbb82596b7481f73f474e59e3253ef77993cf620a4f4b1ba6c1009138565144412cc5c7043d919b802295515b982967d48f7
SSDEEP

768:rQMDMIAN+8bMRK870PlRCdC23gnUyXGIj8arq6HLorC3G:kM/AN+8kK87gRkN3gnUy2Ijc6Hn3G

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
950e2160d4dc979bce4b69887e043b6d_JaffaCakes118
unpack001/out.upx

Files

950e2160d4dc979bce4b69887e043b6d_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 84KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 96KB - Virtual size: 95KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 640B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ