25f8d861b88cfcaa4ffc9dec981617b4_JaffaCakes118 | Triage

Sharing

General

Target

25f8d861b88cfcaa4ffc9dec981617b4_JaffaCakes118
Size

42KB
MD5

25f8d861b88cfcaa4ffc9dec981617b4
SHA1

27a2d85aca1d13f541f8a70903efb8eb5f62954c
SHA256

0a251810abf9d408cba22d67648bf6bf47b9a8476781558a5ad9f4854c4ba6e5
SHA512

fc79221fcc4fe664381196a78548d7e151b3a32bcf6cc93f7f0b80f59799d7eb0aa962dc7e8276b1e8d1b3f2835c6b2afd6613bf62eb2e4af375869c6b36dc63
SSDEEP

768:o5YEXqhHJyGIaM/ti6OkeDtMPlIpJ2XcRfojJ9X9RbCPq9DqKDlDyUY88/9//:8xaqGDM/MdZDtMk0MhojJ9Xvea4z8u

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
25f8d861b88cfcaa4ffc9dec981617b4_JaffaCakes118
unpack001/out.upx

Files

25f8d861b88cfcaa4ffc9dec981617b4_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 28KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ