ad4d8873eb38645d84593236f879f721_JaffaCakes118 | Triage

Sharing

General

Target

ad4d8873eb38645d84593236f879f721_JaffaCakes118
Size

199KB
MD5

ad4d8873eb38645d84593236f879f721
SHA1

b79c2cfe220cbef9f0256c19a4c02e56e8b8ae54
SHA256

08d1f20edc39781ef35013a40cedebaa04e760410a75b2c4ad206c5e8f6aedf1
SHA512

e10c3072eb48907fa035f2cdff76610398e2f8ebbc3de928a84a119cb3c9b34c5cb0c5cd3e3d27741812afbcf6887f163318f4ca95841bb4de7b925ba631adf9
SSDEEP

3072:iAShbJs74xm6cnmd9FjXoLtkifiZfefOqUOvCBYk5ayMPRVJogh4ydDeuwe9nQ:iv9xmnaXoLtkiqw7CBhPMZjDh4C6Yn

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
ad4d8873eb38645d84593236f879f721_JaffaCakes118
unpack001/out.upx

Files

ad4d8873eb38645d84593236f879f721_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 120KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 123KB - Virtual size: 124KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 75KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 172KB - Virtual size: 169KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ