a21498d259f32402dbaa0d281b7780a4_JaffaCakes118 | Triage

Sharing

General

Target

a21498d259f32402dbaa0d281b7780a4_JaffaCakes118
Size

22KB
MD5

a21498d259f32402dbaa0d281b7780a4
SHA1

7ed027098a9c185e3f7ccb53368a3ad22e6a265f
SHA256

5020b35928b740e3f91369213c9b7639af9a991b1e47bf59de4ce2177477d458
SHA512

1ea5c7f2e7552d3cb3b995df0f1af0d712996d44fc5be67ab4b2b6826dc1dc5e92862a7eda79797eb22bf0ab09bb956fd73ebe96148b46c0efbf1df54a0c4a40
SSDEEP

384:NeRn12Y7OzwZv45fMfMv8cgvgX0oJDumrs6WHYkF702FtvIK9NCm/Cb:NeREYOaEym8cGgXDhumwlL1Tgecmk

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
a21498d259f32402dbaa0d281b7780a4_JaffaCakes118
unpack001/out.upx

Files

a21498d259f32402dbaa0d281b7780a4_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 40KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 20KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.data
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ