bfde0814b395e8e53c6c074e0f3c04ac_JaffaCakes118 | Triage

Sharing

General

Target

bfde0814b395e8e53c6c074e0f3c04ac_JaffaCakes118
Size

53KB
MD5

bfde0814b395e8e53c6c074e0f3c04ac
SHA1

d1dc892072874daa7fc2df1712423764f5fa2910
SHA256

1d1ed4895de297116776e50168db7d71fbc47099528b9dd0798cb918bce5a30e
SHA512

7d28793d9a20e2422d47db7787d748604ab94759a41b306d5f14aa87328ab589b3593b98a90c46c8d3400ad409a35ad8b2fa7b43a72148af3ff15e825dcbb77b
SSDEEP

768:w4WkO59vXx47ATDHKPNI/+uuwaLNos/mDTQZIhEr+/ouRd0R96b:zWk8Jh47A/HKP+/yLN4QZOEed0T6b

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
bfde0814b395e8e53c6c074e0f3c04ac_JaffaCakes118
unpack001/out.upx

Files

bfde0814b395e8e53c6c074e0f3c04ac_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 104KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 49KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 140KB - Virtual size: 139KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ