b4f0baa3d87400258dd022de55316efd_JaffaCakes118 | Triage

Sharing

General

Target

b4f0baa3d87400258dd022de55316efd_JaffaCakes118
Size

334KB
MD5

b4f0baa3d87400258dd022de55316efd
SHA1

68aa129791c18d530eed0a224df8b76524d0c3eb
SHA256

c37196c702a0603a3914a54e93119e2b980ac51f3d6aa3106d1f559c0aba782a
SHA512

e1d12b4dd0dc6ac23ca3e8a43d28373f750ed3c52bc89cd0854233769c5a3f6420ded342ad43dbc90f4730872d0b3dbb9971a7f5e6b44351f044e8b861822318
SSDEEP

6144:h0UCKerxmO/a5r76ZeNepNvQAvFMozw97TRmN/i8Ai1iBVnM/ReUuF:e7YOi5r76Ze4nZHSTu/fsBC8U

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b4f0baa3d87400258dd022de55316efd_JaffaCakes118

Files

b4f0baa3d87400258dd022de55316efd_JaffaCakes118
.exe windows:4 windows x86 arch:x86

371911b227edbe7096336cc847f8ecad

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

GetProcAddress
LoadLibraryA
GetModuleHandleA
CreateFileMappingA
lstrlenA

shell32

ShellExecuteA

Sections

UPX0
Size: - Virtual size: 536KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 321KB - Virtual size: 324KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.KK
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 524B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ