b1f9af449bd4324f52018a1fec7de5c1_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b1f9af449bd4324f52018a1fec7de5c1_JaffaCakes118
Size

25KB
MD5

b1f9af449bd4324f52018a1fec7de5c1
SHA1

1eaf07ee5dd2f1eabfddd96e686286ab1ebe27a2
SHA256

9452bf0a74056bb85c044bbbca0c9ff515a0020c53b5df03655a4000989f2c69
SHA512

cf2cd16da743a6c8304f428209cbbb7926e7f64a28f6d1604d58b4956c9fdd6c4ceba60ef838da1e1f7d01ddee66ff849b8500ea5bb43b8755cc8c18c10a8e82
SSDEEP

384:zRor7FMxg33swFgYeasMk4TeQT90j7UDOmjF0NH6cHBuFxzd+mk:Gr753FgfZMugZjSV/gX8

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
b1f9af449bd4324f52018a1fec7de5c1_JaffaCakes118
unpack001/out.upx

Files

b1f9af449bd4324f52018a1fec7de5c1_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 40KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 10KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.data
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ