d4a5603d2a6c1333bf0db4d79b16f520_JaffaCakes118 | Triage

Sharing

General

Target

d4a5603d2a6c1333bf0db4d79b16f520_JaffaCakes118
Size

20KB
MD5

d4a5603d2a6c1333bf0db4d79b16f520
SHA1

6be01223fb8acd58490cd46a58146628aafcfeb1
SHA256

d5bb74085f7d9cbd1a7d573aae3418452005a887b0a98b1e011ecd1beb143710
SHA512

ad7a527cda38ce027cdc6ba85f7c9069ce645c53cc5d51c440efb6f72f6eb89fb7fd5d156f5f8f107b5b36a4aab60ec47fa47852fb9d31c0bf346912fc4e076e
SSDEEP

384:UKDxiAhlPUzsGEq1BNhklY2ybOJ9T4qBphOC1kc/jf7qQLbEg2SNJd:UKDnlczHVXwlgez+c39vJN

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
d4a5603d2a6c1333bf0db4d79b16f520_JaffaCakes118
unpack001/out.upx

Files

d4a5603d2a6c1333bf0db4d79b16f520_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 20KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 18KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ