ef49481918daf51938499d77cf61a412_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ef49481918daf51938499d77cf61a412_JaffaCakes118
Size

941KB
MD5

ef49481918daf51938499d77cf61a412
SHA1

09687abb9d404314705ec10137318773d8ec18cd
SHA256

855fa5da7aab679dfff19cc482b2e2e74f759e9bbd3c68dbc275046614ed8ab7
SHA512

b807b7bd678b7becc37a920f2134edd215abfb0d093fa86496a565f334e61b508b4dcb68b80e84373712e1c2348d2445e9c41fff94e8a9c335f822f75f22d995
SSDEEP

12288:kjI/KjRqapBYmzzEJlTWXE/glpgYC7SdoAI+Fk2aimpc1c57nVu7lNHAuyZoA0Y:k6CXp7zzEJkXEYlfkyETpr57ViFI

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
ef49481918daf51938499d77cf61a412_JaffaCakes118
unpack001/out.upx

Files

ef49481918daf51938499d77cf61a412_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 60KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 9KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 23KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ