a949c51445745894e4be90cc2c0766bd_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a949c51445745894e4be90cc2c0766bd_JaffaCakes118
Size

86KB
MD5

a949c51445745894e4be90cc2c0766bd
SHA1

64c6101e9b46c651272fe1950e38d5efa943a580
SHA256

48ddd3bac19df7af549f07994b9138f797b3b2100fe54bca72329dd267d10eaa
SHA512

d58bfd77264d88730b652adf295911595fcf532e15160fa26cc9a5681f263906533b726133465b3cf4eadca6372963cab6591e81cf69cd6518549d6c27340b58
SSDEEP

1536:wpv4NFUqaYJu/xqg8FFX2EcRm5YFnGZlh98qvAUU4W5JqnhEHy8:wpIjaWggZlcRm5YFnGfgx4W5JBHH

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a949c51445745894e4be90cc2c0766bd_JaffaCakes118

Files

a949c51445745894e4be90cc2c0766bd_JaffaCakes118
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 4.3MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 609KB - Virtual size: 612KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 25KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.payload
Size: 5.0MB - Virtual size: 5.0MB

IMAGE_SCN_MEM_DISCARDABLE

.opcandy
Size: 293KB - Virtual size: 296KB

IMAGE_SCN_MEM_DISCARDABLE

.bunndle
Size: 130KB - Virtual size: 132KB

IMAGE_SCN_MEM_DISCARDABLE