b89c838664d6927b46ea9c69c67661ef_JaffaCakes118 | Triage

Sharing

General

Target

b89c838664d6927b46ea9c69c67661ef_JaffaCakes118
Size

82KB
MD5

b89c838664d6927b46ea9c69c67661ef
SHA1

1b62648e33aa8127750d1b8abb14d125270874df
SHA256

750673d8e0b06b7f75e3a7a652600d4475b8e086f7e5e9a0bd2edbab21214e51
SHA512

a9813a6bbd5c763d0f67fc9ac5065dad1a6d0deb9642a17a761b2da4b6d65fa37923cb8ca98c2df696548cb8c874a8be3e7c7063a593f00ca168a11f27e0f393
SSDEEP

1536:nY4SK8fZjZmgbOSZm1od9Vtob3UJ0K90C3XXqu0x/fxRbBPEgkMjKCVi8QMvLC8T:Y4QBjQg6Qm89VtobkJ0K90C3XXKVfxAi

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
b89c838664d6927b46ea9c69c67661ef_JaffaCakes118
unpack001/out.upx

Files

b89c838664d6927b46ea9c69c67661ef_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 428KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 78KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 476KB - Virtual size: 472KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ