a3f064f2d01a684b19f389945adb3cc8_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a3f064f2d01a684b19f389945adb3cc8_JaffaCakes118
Size

75KB
MD5

a3f064f2d01a684b19f389945adb3cc8
SHA1

9136755837eecd3c7b0a7c27e099477f65797a68
SHA256

93983f723b618991e1cf50229aaf06a3b7f1ad285daca00d73ee4025c6f03b96
SHA512

bc3421d9cfd89e59dfeb5f62b9834ce3b570c96d254509697ad69d89f7c0745e96aef76fef94c3ede13586c545b5bbd20a1f35729da016c219a791b9051270bb
SSDEEP

1536:N6MHBHqDBVjLPd1ET4xL4A+NAjTp6PpJPWAwCI+0X6g:N6MhwPPbETucAtoJwP+0X6

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
a3f064f2d01a684b19f389945adb3cc8_JaffaCakes118
unpack001/out.upx

Files

a3f064f2d01a684b19f389945adb3cc8_JaffaCakes118
.exe windows:5 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 84KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 70KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:5 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 71KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ