a61fc4a31bcd738e7173ee49027fb835_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a61fc4a31bcd738e7173ee49027fb835_JaffaCakes118
Size

192KB
MD5

a61fc4a31bcd738e7173ee49027fb835
SHA1

e925c229e130ab7556230f7f75afabb7d8605bd6
SHA256

0cbbf5bcfca42cbeabba0fe18d9e43659cfc586363fc95dac9b9e2137cd20501
SHA512

a401bce562b613cb023715f6cbc93a640f99ede9ab843708cf9ad705cd0106fdba5c139da09a717c1f110d484e3e245e69bff7d5e28f2bf2e07aabb5b0215c42
SSDEEP

3072:JVq2j9FsHE3oPc94mn8BlLKGV1oW548Biscap8aI6UBGQ/TfEc8OvwR:zPRF+Eic945zLKGVC8BJrpw3jEc7o

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
a61fc4a31bcd738e7173ee49027fb835_JaffaCakes118
unpack001/out.upx

Files

a61fc4a31bcd738e7173ee49027fb835_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 604KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 186KB - Virtual size: 188KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 628KB - Virtual size: 627KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 144KB - Virtual size: 141KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ