a602f716f5992f70a4c2121b75d07567_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a602f716f5992f70a4c2121b75d07567_JaffaCakes118
Size

10KB
MD5

a602f716f5992f70a4c2121b75d07567
SHA1

30066d16e2ecf5c4ef9cdd35e11d98f92154fdff
SHA256

359cdcf0492aa292cfb15b299b0e1240e40294383761fcb2ff4fb30d1bf03b3f
SHA512

a0cdefe39fb49770f16fb5d7047cdb6fd5257e253e1be766d05f1dbcc1d4cd9efa84f459f6c468032a5d4b1116ff9e78227e6a8bee34da59ca3f63b262206ad1
SSDEEP

192:FHMppn5dj6H95krwTLQSZQWyInRBxwwKPO:I5dO98wTNlvgW

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a602f716f5992f70a4c2121b75d07567_JaffaCakes118

Files

a602f716f5992f70a4c2121b75d07567_JaffaCakes118
.exe windows:4 windows x86 arch:x86

95dc23414200e99be0fd79f7bf0c9a41

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Process32First
GetFileAttributesA
GetLastError
GetProcessHeap
HeapAlloc
GetCommandLineA
GetStartupInfoA
CloseHandle
WriteFile
CreateFileA
CreateProcessA
Process32Next
WaitForSingleObject
TerminateProcess
OpenProcess
GetShortPathNameA
lstrcmpiA
CreateToolhelp32Snapshot
DeleteFileA
GetSystemDirectoryA
GetWindowsDirectoryA
FreeLibrary
LoadLibraryA
GetProcAddress
GetModuleHandleA
ExitProcess

comdlg32

GetFileTitleA

urlmon

ObtainUserAgentString

wininet

InternetReadFile
InternetOpenA
InternetOpenUrlA
InternetCloseHandle

Sections

UPX0
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.avp
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE