bf330a1b094e623b5d5f5792a1d35f57_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

bf330a1b094e623b5d5f5792a1d35f57_JaffaCakes118
Size

22KB
MD5

bf330a1b094e623b5d5f5792a1d35f57
SHA1

147e42b5878ae90c8487f5ae3b52e0ffd08e89a7
SHA256

17ee24861b916d9d1d06c504e54aaccdf72f4b61ec1e20b48e17802f0505e231
SHA512

eba6e40e17af302f518438c167e018d4a922ed448a35aa740da3ab526d4ac121660b0a8ed3b4515a6e92ce54bddffac37c6ddb4f905a797fc7774961fd14220e
SSDEEP

384:IS8wxWHMCTrqZEtLIJRu402MItu6NH3ZUwmuRS46B9KkP1k39:TZYHBNhIEkH3Zid46BMi

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
bf330a1b094e623b5d5f5792a1d35f57_JaffaCakes118
unpack001/out.upx

Files

bf330a1b094e623b5d5f5792a1d35f57_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 40KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 20KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 277B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE