a483cad130bbf4b50c643a3ba2c807ed_JaffaCakes118 | Triage

Sharing

General

Target

a483cad130bbf4b50c643a3ba2c807ed_JaffaCakes118
Size

90KB
MD5

a483cad130bbf4b50c643a3ba2c807ed
SHA1

051bca86f1feb2e51805b9a02d14c8485083d942
SHA256

f20f9a5170bb811b2029a06185dc61c9828908229c348f49e08df69e7664413b
SHA512

cad9f764b8f59305494fd74a41c088b1dbf3131e55665fc7c4d9a457e79524f97a3deb3e7bbc8fa8c3d54948ee87446310df6db9aeddc261fae76ceb70c2ead2
SSDEEP

1536:dZGFkwfwh/lIBGDE+r5ZKEU2Cx9Ao0XpIcTUkKamMAs57SNZMY3GgH4/:dZbwfwABEE+r5UdDxqXNbKamaINZM6Gx

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
a483cad130bbf4b50c643a3ba2c807ed_JaffaCakes118
unpack001/out.upx

Files

a483cad130bbf4b50c643a3ba2c807ed_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 176KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 89KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 180KB - Virtual size: 178KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE