b9faeba6f815340fc5a4d14067fb8d68_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b9faeba6f815340fc5a4d14067fb8d68_JaffaCakes118
Size

4KB
MD5

b9faeba6f815340fc5a4d14067fb8d68
SHA1

848668210d3fc33b1d3b0831bf34f76e550cb605
SHA256

2daf9ac74ad3539f93b8615eae3e009a952f88578e7099b67ab857f8097e07fd
SHA512

98adea0dccffceaa3e5c161edb0d6f2dc7c87679b44636e1b6b205da09c39d199bc821bf5c425715f12e3dc4da741a51e061a34502cdf2a3ef0952cbf56fdccb
SSDEEP

96:2+3gdyXZAJDK+TwxgDAeFdN/ennlaF/J9FS:2+3AqAe6wq0eTN/enUx9FS

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
b9faeba6f815340fc5a4d14067fb8d68_JaffaCakes118
unpack001/out.upx

Files

b9faeba6f815340fc5a4d14067fb8d68_JaffaCakes118
.exe windows:1 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 20KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:1 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 760B - Virtual size: 760B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE