a8a2e5f897a9bfb186deccacd8fcc4fa_JaffaCakes118 | Triage

Sharing

General

Target

a8a2e5f897a9bfb186deccacd8fcc4fa_JaffaCakes118
Size

90KB
MD5

a8a2e5f897a9bfb186deccacd8fcc4fa
SHA1

a8f9324608641f23c7a88f06320fe17d5e950ff5
SHA256

edfb2f7238b12d1f4fec81afc0474e1d872606c502cdc679189a611e13423ce0
SHA512

caa9614af49e8748d197869f7075aebe3961c1521fba456adf084c4b22cd40c6d31e81b0fda659dedf45c4292f0f790026950c62f2a714d9bab9e145e40d539a
SSDEEP

1536:BpkRnh2K2ZQWO4yo8Tre8erlGPPloV4o6F6dq6cJFiMJOuYDXFX2e:BUh2hQWO4yo8u4P2V43F6dTcJcMouYDF

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
a8a2e5f897a9bfb186deccacd8fcc4fa_JaffaCakes118
unpack001/out.upx

Files

a8a2e5f897a9bfb186deccacd8fcc4fa_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 176KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 89KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 180KB - Virtual size: 178KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE