95c7eb2a54131c61dbb78d19eed8358f_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

95c7eb2a54131c61dbb78d19eed8358f_JaffaCakes118
Size

36KB
MD5

95c7eb2a54131c61dbb78d19eed8358f
SHA1

51452904846ca7922716b5c73aec3b18513e23dd
SHA256

d7de4022b7f23f49ab66f8496694b09e3f49fd28a47f1d7ecdc59c83abee3c04
SHA512

3b245eb222669889f2e8bc42aa26aa2920e3194cd5846d13d91a70d27d352e39127737eff7e6316430b2744e70528485c114add44f66f8dc773156375cff5f52
SSDEEP

384:wqfPgarTzZBTsTbNLxgkChgDQpOwRkL74j/srwVMYWi8fU0p45NNlWIWZGAXgcCJ:n4WzZqLIgDQpvknbrwVOiWfp4uCgVR

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
95c7eb2a54131c61dbb78d19eed8358f_JaffaCakes118
unpack001/out.upx

Files

95c7eb2a54131c61dbb78d19eed8358f_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 52KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 27KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 40KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ