b148169de7305a120323bae4d05093f5_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b148169de7305a120323bae4d05093f5_JaffaCakes118
Size

389KB
MD5

b148169de7305a120323bae4d05093f5
SHA1

3df7a415e7a5c4a4da88db713e1dd3ba4ef349ba
SHA256

f04202cbee068bc43fd1c7e5bb54cf9dadb6b7a2adb3eef2028f74dde85a5bfd
SHA512

0bf3167c10c6796c697021449e579f0479d29638e7f32b3dc816f4c5753bb5ce8eba53a8eaf76909d4a6ab7ed55c4a535a26c83ec40453cf76b9f004084406b6
SSDEEP

12288:+tNMhGI/l2AV2J6u4uyPJet44XoFEtaXN728poS/:+tSEIMAfxIXTtaXkC

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b148169de7305a120323bae4d05093f5_JaffaCakes118

Files

b148169de7305a120323bae4d05093f5_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Exports

Exports

?AfxGetMacAddress@@YA?AV?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@AAV12@@Z
?AfxPrintAllMacList@@YAXXZ
?CalcFileMD5@@YAHV?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@AAV12@@Z
?CalcStringMD5@@YA?AV?$CStringT@DV?$StrTraitMFC@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@V12@@Z
?base64_decode@@YAHPBDPAX@Z
?base64_encode@@YAHPBXHPAPAD@Z

Sections

UPX0
Size: - Virtual size: 916KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 382KB - Virtual size: 384KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE