b5e18b71f26eb7fdad3fcbdd9d0524ba_JaffaCakes118 | Triage

Sharing

General

Target

b5e18b71f26eb7fdad3fcbdd9d0524ba_JaffaCakes118
Size

244KB
MD5

b5e18b71f26eb7fdad3fcbdd9d0524ba
SHA1

6b61cfd0498addb5b4013f231028fe32383be0e3
SHA256

a90dd6dbe51e59516ef7f670f6b1fea727a2d9e4cbdd32dbeb207859a6e7a4dc
SHA512

6abebb546b04eb1c7fd7e19c3fb59e34c723fe8a65071ff08b955e94d68aa20b520252867f8fbe7cce63b44cbc21eead3b3bede33c0ed7df5bb208a15fb9acb2
SSDEEP

6144:csUFJRdw3a+wN0Css46AOYCDOvYstJzoYmyp8Cwd:csUFhw3a+V9aa0mkZ9Ca

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
b5e18b71f26eb7fdad3fcbdd9d0524ba_JaffaCakes118
unpack001/out.upx

Files

b5e18b71f26eb7fdad3fcbdd9d0524ba_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 548KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 236KB - Virtual size: 236KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 768KB - Virtual size: 764KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ