150c03aa3153ac69625a0fd980e17135_JaffaCakes118 | Triage

Sharing

General

Target

150c03aa3153ac69625a0fd980e17135_JaffaCakes118
Size

92KB
MD5

150c03aa3153ac69625a0fd980e17135
SHA1

0e5bfeaa781572ae5fbda282545d3a2c65fb9067
SHA256

06d75a2b30dec97ecfcd5b7347936036f04464c21407dbbfbf124f2429c2ec6e
SHA512

a7cb6659e58981ae4ac830dc8205f69dd069d748bcf64e2d8a321f81d48db1364ced3995cddc131fbf27ecaf2e90bed93596a495327e47e432625bdec9a0811c
SSDEEP

1536:zL03B8Jv+jyzvqEFyil2mVyhHNAxb7zJufYV6xdQmi8wXTGELE3jQT6XXla+8cjo:E3q+jGpIhuxb7lUYExdQmi8wDxETU6HS

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
150c03aa3153ac69625a0fd980e17135_JaffaCakes118
unpack001/out.upx

Files

150c03aa3153ac69625a0fd980e17135_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 236KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 88KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 300KB - Virtual size: 298KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ