95aefe451811d3399274ddce2005663d_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

95aefe451811d3399274ddce2005663d_JaffaCakes118
Size

64KB
MD5

95aefe451811d3399274ddce2005663d
SHA1

064499447d7b409d82f9c49d645b34e87975efd4
SHA256

e49a515dceba223c8141309658ad90f89483bf4cd7f6c031d5bb9ca14fb7ddd4
SHA512

80fc37fd57d3805c83cfbd33834e3e7512d5f27c0cda0c115b517aae904063f1a0d6c1ec2f813a0aa0b11af207d7e2ce8bb7087a5ad820d3dd499d0154f1951c
SSDEEP

1536:BhD0fYgVepNq1gB2o/zdglGiOut20N0+Vh8y4b55NzNP:BaAgVsNf/zd2Gin209Vh8jt

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
95aefe451811d3399274ddce2005663d_JaffaCakes118
unpack001/out.upx

Files

95aefe451811d3399274ddce2005663d_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 48KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 28KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 44KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE