96a9cf0ae0e0c494c5c2332f4089f17e_JaffaCakes118 | Triage

Sharing

General

Target

96a9cf0ae0e0c494c5c2332f4089f17e_JaffaCakes118
Size

696KB
MD5

96a9cf0ae0e0c494c5c2332f4089f17e
SHA1

bcf9c76a75988cabf34b1f16b81f6550828d6e01
SHA256

589bae8f594f4259c0f7c41192939a9d38d693fdc48061ef017ebe311f794b9a
SHA512

a7ed856b6c078216ba23abdabdb585c1cbbe39fd49b20316c766b073c4c46cc4f204fd8863cebbfa26679977d84c4b9a5196e6b11349761ced26e0fba0f50501
SSDEEP

12288:WqX3QwsKoRjtMEztFwpq3vuxcjaRRMItSdgoCYyLEzshAblVv/z+LzmwK82U8Loi:WqHQrBJMEzbwGG9C6JoC4zshaHzkszUe

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
static1/unpack001/mara-fix_1.5/Eset Fix.exe	upx

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
static1/unpack002/out.upx	autoit_exe

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/mara-fix_1.5/Eset Fix.exe
unpack002/out.upx

Files

96a9cf0ae0e0c494c5c2332f4089f17e_JaffaCakes118
.zip
mara-fix_1.5/Eset Fix.exe
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 476KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 224KB - Virtual size: 224KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 117KB - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 408KB - Virtual size: 407KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 90KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 124KB - Virtual size: 124KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
mara-fix_1.5/_Readme!.txt