a9c859dd812c130a4ad8228e8ab38492_JaffaCakes118 | Triage

Sharing

General

Target

a9c859dd812c130a4ad8228e8ab38492_JaffaCakes118
Size

140KB
MD5

a9c859dd812c130a4ad8228e8ab38492
SHA1

1717c2abb007097da9925f8903b29917b3113d1f
SHA256

e67fa4b3e55ac1e77685f14d6e5efa7204e42aba651ef1f1ecc290331c2b61e8
SHA512

8ce0cf271e88fa3e68c11fef675607675ebcceece18671f0c7944fa95278b71fb3e7fcf0920c2ea04fea158aebab844ee94d63cb7feac8fd2b9cf4accbf82dd0
SSDEEP

3072:Q2/E7qSaQL5vJssw75ZhkfgUxF08myEI/eMC:QME7qSDsbhkIu0kEI/e

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
a9c859dd812c130a4ad8228e8ab38492_JaffaCakes118
unpack001/out.upx

Files

a9c859dd812c130a4ad8228e8ab38492_JaffaCakes118
.exe windows:5 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Sections

UPX0
Size: - Virtual size: 72KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 132KB - Virtual size: 132KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:5 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Sections

.text
Size: 97KB - Virtual size: 97KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 86KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ