070f414ebbc5f2fe917d5082936f3a09_JaffaCakes118 | Triage

Sharing

General

Target

070f414ebbc5f2fe917d5082936f3a09_JaffaCakes118
Size

577KB
MD5

070f414ebbc5f2fe917d5082936f3a09
SHA1

60f5a170781e9f022c2eefc5434d6bda147684bd
SHA256

af9ed336328518b1ce93f940da36f36345c5fcd85563f952b92b4aed68af161d
SHA512

7228380bddff3773eda07798754142f5d91573978c043189d7ddb316d287ef342ee7e3518e9420bd555bbdf8e35fc06b566f5c7e7121f748e7b161240e00bf59
SSDEEP

12288:30msGoc084hkaQYC6UKTb92UKP0P1MsAIr/qiSnkrMdnKAvn:EmzJISYC/Wb92PsP1MTIWxnHnKK

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
070f414ebbc5f2fe917d5082936f3a09_JaffaCakes118
unpack001/out.upx

Files

070f414ebbc5f2fe917d5082936f3a09_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 60KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 15KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 561KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 56KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ