0e3f40913cddd42c5946e77f24e52c0a_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0e3f40913cddd42c5946e77f24e52c0a_JaffaCakes118
Size

270KB
MD5

0e3f40913cddd42c5946e77f24e52c0a
SHA1

f17b1af647173121d8daecd0110c4d5058a3d895
SHA256

a97277c95cb5553d66fc58f60b5f79ab83c06f4dc104914cc641c953cc7da619
SHA512

e8105f21edd2c5ffe95a6a5c7d98c209230fbed2c4db587afe7936e6bcfb9535645326c7a84fe30e7a455f430cfd02e72824a37cb69a669aca2a38415155b3e1
SSDEEP

6144:hucLoiky3uqIbAY7XGySmZJF1hgdHBYshXLraaAcI:hkfqIbAuhZD1hgdHBYsFraaAb

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
0e3f40913cddd42c5946e77f24e52c0a_JaffaCakes118
unpack001/out.upx

Files

0e3f40913cddd42c5946e77f24e52c0a_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 472KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 265KB - Virtual size: 268KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 660KB - Virtual size: 659KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ