c9595494df51a4d76d7b575bed955c93_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c9595494df51a4d76d7b575bed955c93_JaffaCakes118
Size

566KB
MD5

c9595494df51a4d76d7b575bed955c93
SHA1

947a95c75c69659df34ffd47bfe14be55d4f8677
SHA256

596852a0e1d77253f20dd67b8421193950bf539b3417f8da5a62c52b5584c2c2
SHA512

306537869a7321c95dc9ac6d316d993cf4a24d409c12c4605d3332eee394258be1b02f4a541c65d5259a9fd529f8d12355756aa4b21f8e649459e6be7c4985b7
SSDEEP

12288:ehN1+dxL4Ax+U352Rqhj//qMnUsesn8b3VjtCL1y8LAFSs:ehMx8W3rhD/j6snUjAMFSs

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
c9595494df51a4d76d7b575bed955c93_JaffaCakes118
unpack001/out.upx

Files

c9595494df51a4d76d7b575bed955c93_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 964KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 533KB - Virtual size: 536KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 31KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 272KB - Virtual size: 271KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 48KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ