bd51dbaf78064d30f596829cb2aa3293_JaffaCakes118 | Triage

Sharing

General

Target

bd51dbaf78064d30f596829cb2aa3293_JaffaCakes118
Size

678KB
MD5

bd51dbaf78064d30f596829cb2aa3293
SHA1

4166986c29b908a4bdfce574d834047d1a69ec54
SHA256

e0650c9eb8deea44596363b7d3e8421e01882e710de83e16865c932e01329ad8
SHA512

1d1bf832896503518cff578128460029ba32777db30b43d5930592e313fe1b15cb2bb35148593fd4bc62d1b51f9fc6753a0623cdeebc34e0d06cd1c0fee46a15
SSDEEP

12288:ljMJybhetR02kX7EX52cN1MfFP95upjkY8SxEZpXU1nLQi6ZPvLTvG67v3A:ljMJy2R0Z7EX52cDuVup5uZpXU1nL4P/

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
bd51dbaf78064d30f596829cb2aa3293_JaffaCakes118
unpack001/out.upx

Files

bd51dbaf78064d30f596829cb2aa3293_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 1.2MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 672KB - Virtual size: 676KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ