b45ba8e9a906927be42c9d40cb2639f5_JaffaCakes118 | Triage

Sharing

General

Target

b45ba8e9a906927be42c9d40cb2639f5_JaffaCakes118
Size

7KB
MD5

b45ba8e9a906927be42c9d40cb2639f5
SHA1

214823f413e1efc7e082183a2b6dff7bfe587f47
SHA256

2f30f52c8c08493df32f703a98faf2150506a1f107a1ab929c1043a4b22a9dca
SHA512

f403bc92ac34fc5713a0e61a88baae3ea8e2df45f0ba5fe20017223afe3c07bcf81c252b895b794665117f42d594df7245f5d358179f5828a0114ba547f3944b
SSDEEP

96:jI363Zes2WcXY2z4wOYVXs0tyhkaaRCDac6Ik5ItealWtgLyb:WMN2Wc5z4cVXs0tyzDluIt1lO1b

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
b45ba8e9a906927be42c9d40cb2639f5_JaffaCakes118
unpack001/out.upx

Files

b45ba8e9a906927be42c9d40cb2639f5_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 24KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ