eb63477d1fb4a050ccc6c1c93cf0183c_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

eb63477d1fb4a050ccc6c1c93cf0183c_JaffaCakes118
Size

115KB
MD5

eb63477d1fb4a050ccc6c1c93cf0183c
SHA1

2594c7a84f6af926e1a9269f215d51615b6e9437
SHA256

42310f6e3716054913c0052f0e41d83ed1a1ab51c9c4fbfcb3c97579346c9684
SHA512

f4ba3cff481d873ad540bc2d53b7200c53d2b41baba4b8c997d41dce5dc178b7651cc9efe84f9adbf863bbcead7437af4b67023dfaa58a57f0f98e3fc76b7b0c
SSDEEP

1536:E/Ef95t47gz4KhkmEcR4jsthOAgIanEmpUFnrYb/ZhR0DKQ12tD8Lcc61OK0S47g:+a4KiRjdI6S9sb/be2lx8Lo1OLShF

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
eb63477d1fb4a050ccc6c1c93cf0183c_JaffaCakes118
unpack001/out.upx

Files

eb63477d1fb4a050ccc6c1c93cf0183c_JaffaCakes118
.exe windows:5 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 104KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 67KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 47KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:5 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 83KB - Virtual size: 83KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 65KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ