dc20a67efa59d9e872f07e3e0b8d301e_JaffaCakes118 | Triage

Sharing

General

Target

dc20a67efa59d9e872f07e3e0b8d301e_JaffaCakes118
Size

244KB
MD5

dc20a67efa59d9e872f07e3e0b8d301e
SHA1

53b4fd44d6dc430aeec6c60b2b68aa8adaa01369
SHA256

00edcfc15605e1415a938f15b2983903a6ea9720f0f7e4de5f0aee6f0591c959
SHA512

4eb958c4e1e0fa82ce0c9e0a38dd949feb4198f5e03a94274aeea1dbe9e055fab0b5fa5cf77048aeded64dfacdcf0a192a09526388e9af7fe8e28245f0c3be4e
SSDEEP

6144:MCD9F6lKGB2V7tlzGAEzBKJ8pq81sZkxGyGgKBrqRHuxYK9V6:HFaBU7bEQOD1sZkxGBbB4HY9V6

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
dc20a67efa59d9e872f07e3e0b8d301e_JaffaCakes118
unpack001/out.upx

Files

dc20a67efa59d9e872f07e3e0b8d301e_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 380KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 164KB - Virtual size: 168KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 78KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 440KB - Virtual size: 437KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 84KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ