daa1551e0cd0475b3bda8b3bc8255817_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

daa1551e0cd0475b3bda8b3bc8255817_JaffaCakes118
Size

35KB
MD5

daa1551e0cd0475b3bda8b3bc8255817
SHA1

d4eb47ee55d127078151e02e7429a86129f2880e
SHA256

67f3720705c54f079a1b158625f6daeb3a1a2632eb56487c6fcdef8174ccd9b7
SHA512

69707462d5fa388f6fd89d933bb28c932ff483373ca7882b88d0697c1c81d1f750eb3e0c1bff57d2ecfefa5b63419792456b86ca4c0067bd78bf1d9615468637
SSDEEP

768:2zhQSPcRy3SHPRf24VaArVhRKJw01S/XcUbG7ZIGwt2u4:2lnPgy3624VaAtNAgPG2Gwt2P

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
daa1551e0cd0475b3bda8b3bc8255817_JaffaCakes118
unpack001/out.upx

Files

daa1551e0cd0475b3bda8b3bc8255817_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 76KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 33KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 72KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ