d09f2464c10f37b425f53c2c2c7c2661_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d09f2464c10f37b425f53c2c2c7c2661_JaffaCakes118
Size

19KB
MD5

d09f2464c10f37b425f53c2c2c7c2661
SHA1

1372b630971b3c19c36fc380803e34629c5d98a0
SHA256

6ec58daa3e4ce86acd7298b8b39179c4a69e7cb38271ee8c5a924da76c25558a
SHA512

48effe39418c2ec4507b03103c064bfa9127bdba8e869647d6ed6280c44a373fab4fc3ee3db4655e570e3635d74b7eacdca036f4321fae8ded56dfcaea202a62
SSDEEP

384:hqiM5apLvxIZKZyErYk/Rmfvifm3yZ4kKDIGbkSKDR1cE4:hqJ4LVrBS8mPkH

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
d09f2464c10f37b425f53c2c2c7c2661_JaffaCakes118
unpack001/out.upx

Files

d09f2464c10f37b425f53c2c2c7c2661_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 52KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

GDEdZ
Size: 44KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

SFFRE
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

HHHHH
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ