daaf39a548db881cf51f70466532eb13_JaffaCakes118 | Triage

Sharing

General

Target

daaf39a548db881cf51f70466532eb13_JaffaCakes118
Size

122KB
MD5

daaf39a548db881cf51f70466532eb13
SHA1

e5739bd6f144f26faac5d4a19b0c3fa99536343c
SHA256

96885082ac6284c9dd2b14f97d50144291db6be11200a4303e658e276d2d137c
SHA512

e94c77e0c7cea7c3bc290861c6c6e82127b57a7e2ac394baf207fc9fbf3608323fe5c1d4782d133230d88fa6044e390204f4ee3cc82fb96960e166bf76fa906b
SSDEEP

3072:HUeZSUk23G+O9BJvvzpxzzgsL8xZdOS1y5XPaHyoA1x6wkvxCH2AZT8:0eg2GF9BhvzpxHgsLYdH1NSo0ovQ3

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
daaf39a548db881cf51f70466532eb13_JaffaCakes118
unpack001/out.upx

Files

daaf39a548db881cf51f70466532eb13_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 304KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 118KB - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 400KB - Virtual size: 399KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ