d6d994570ae16bda89897bdf6a30eb08_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d6d994570ae16bda89897bdf6a30eb08_JaffaCakes118
Size

10.6MB
MD5

d6d994570ae16bda89897bdf6a30eb08
SHA1

c4b714c8d608e376b8a2eb3a2d02120c61482eea
SHA256

20448bb22b80ee8984eac210999f256862df92e2b20587ed26edc2a64fe8f877
SHA512

26818b4d64bb55ce9413807e72efb37c983af77ceba4fc15edee1a91d43d302d2efeb7f253da05bbe46e23f63726f8aaa080dcabb71db5a0a14355a00902e6ee
SSDEEP

196608:brbtXkPuoNGfacdAxlnhMCB5btHwDklP5D6P1f+KSRP7kwdYKlmdDif:fb2WokfWfB/gm2Nf+LPYrKQdDo

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
static1/unpack002/proxycap.5.26-patch.exe	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack002/proxycap.5.26-patch.exe
unpack003/out.upx

Files

d6d994570ae16bda89897bdf6a30eb08_JaffaCakes118
.rar
patch-SND.zip
.zip
SND.nfo
proxycap.5.26-patch.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 568KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 115KB - Virtual size: 116KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 70KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 554KB - Virtual size: 553KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
pcap526_x64.msi
.msi
pcap526_x86.msi
.msi