de6f73f31c25f6b93bc3d8bd47ff9514_JaffaCakes118 | Triage

Sharing

General

Target

de6f73f31c25f6b93bc3d8bd47ff9514_JaffaCakes118
Size

312KB
MD5

de6f73f31c25f6b93bc3d8bd47ff9514
SHA1

bac993096b25db586425ab8ccdae9acd823b7fd6
SHA256

7598f007cd7be2347e701a0b100babbe95a59d326d94f522a1e7b641ac6b73eb
SHA512

890188f5df449e619c3cde6b952e8cf8d1ad2d538a74e886229d834a01f8d6c88eae9368268e85b709f2613f0e699d2bef1de24b85c3ef283154e9e94a465d19
SSDEEP

6144:D6as/nSSs09AkSrz25BWsgRSIKXG73wAHyQzHnxQNqBvs5tKXnm:D9oAPrC5BgRGo3H3HxMtKXm

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
de6f73f31c25f6b93bc3d8bd47ff9514_JaffaCakes118
unpack001/out.upx

Files

de6f73f31c25f6b93bc3d8bd47ff9514_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 368KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 260KB - Virtual size: 264KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 26KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 568KB - Virtual size: 564KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ