badafb899964d306a683789aecd566ed_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

badafb899964d306a683789aecd566ed_JaffaCakes118
Size

31KB
MD5

badafb899964d306a683789aecd566ed
SHA1

a9ef8f46dfec022d708d1f22b9969d88999ce63d
SHA256

c1734e21a8adaa8d2d20a7bb94fceb8896f3231b60699a464a555835d923b7b8
SHA512

19706f7e32ad14ccb8cebc4f535f3f621ea04a071f0aed3cf7b0312976e60197baa80bffd601fcedc8759b556cd87fd0a6aa60371b76375c95dd0dc95a504109
SSDEEP

768:SIyD7ACea64tcHhjaeuHR4uf+UbhMMBe4W:SI47ACv/IhjaeukUhBeT

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
badafb899964d306a683789aecd566ed_JaffaCakes118
unpack001/out.upx

Files

badafb899964d306a683789aecd566ed_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 40KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 28KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.data
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 57KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ