b4113f7a3cd99eb38652135f3f21cd6e_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b4113f7a3cd99eb38652135f3f21cd6e_JaffaCakes118
Size

91KB
MD5

b4113f7a3cd99eb38652135f3f21cd6e
SHA1

ffb2d711180c3c71d3fc648616186ca0fb2413ea
SHA256

3ba10da132dd5a954f56cad87bbe645cfd1caed36d58de6eec24b9b73334e8cf
SHA512

f0f947c9ebc3fe74b5bf1d8ef91bd1d423d992aa25c81fa55e3d149ad3c53ac53f559144707f4c7f2134473e250da35bed2a82f72b9816f0f8546551ee5578de
SSDEEP

1536:yvUsIA0gDZZG718pkdqhEnVAaQHDj7nxKm3DWLzw2nX1oRcDlidwg:eUsIAj9ZK8q3VAa+DjLxKm3KLzrOkEOg

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
b4113f7a3cd99eb38652135f3f21cd6e_JaffaCakes118
unpack001/out.upx

Files

b4113f7a3cd99eb38652135f3f21cd6e_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 176KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 89KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 180KB - Virtual size: 178KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE