f9e922a6e14b8663b2bc577ffe79b0e8_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f9e922a6e14b8663b2bc577ffe79b0e8_JaffaCakes118
Size

59KB
MD5

f9e922a6e14b8663b2bc577ffe79b0e8
SHA1

61fe9babe13c1374e365816c712d945b8b0e81cf
SHA256

d25d837b15eabdd8b30db703308fa4998baf473c0651c1b7d4f88ad212922f2c
SHA512

2a2ffd7b2e7385dc6b263ee27a08a025c3b97854f90d9a6c7aa129b18788a5a8940ec4c0bc245f5699ed666af32afc0a34b582f649abe5b00629c801e20f0329
SSDEEP

768:j7kCNgMUX2p277H9nzK8bItt3TeU9EQYFJa2EdF26oKxh0NQPwyAgbaWoBG7cbch:j46X1M7H9WJ0FJa2Kaq7BpoYhh

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
f9e922a6e14b8663b2bc577ffe79b0e8_JaffaCakes118
unpack001/out.upx

Files

f9e922a6e14b8663b2bc577ffe79b0e8_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 128KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 53KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 160KB - Virtual size: 159KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ