b2552184c66fb062109e96927ab20ec5_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b2552184c66fb062109e96927ab20ec5_JaffaCakes118
Size

25KB
MD5

b2552184c66fb062109e96927ab20ec5
SHA1

20aee0e2ec530372bbb793257d71fb9cb17394ef
SHA256

da4ed3f31ac73d79439b24ba5dc5a557647999cf7a773b92bb59f2d081d2bd0a
SHA512

847894bb184d5d65c109fc7cdecde819ffb2d2a98e2b97b523962c08cddbac89f2c2c06cdcc7d9e6b7a8c398e4b40e61d16b31d565921ccea902ee3f492f9714
SSDEEP

384:hQHsaoHWqIrXZ1Jh7UMuopB8j+V9vIKO1qM7AJ28bu1DYRzkmaE4737ccBY1hk:h2j1Zjh4MPyIuh1q/bu1LmO73Yth

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
b2552184c66fb062109e96927ab20ec5_JaffaCakes118
unpack001/out.upx

Files

b2552184c66fb062109e96927ab20ec5_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 56KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 49KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE