2a02cbd61397fb1c25a83f5ab4d3e97e_JaffaCakes118 | Triage

Sharing

General

Target

2a02cbd61397fb1c25a83f5ab4d3e97e_JaffaCakes118
Size

28KB
MD5

2a02cbd61397fb1c25a83f5ab4d3e97e
SHA1

8861c26323b7c19090c6a2bc33cb8d54c8ea5011
SHA256

4f9e555824181c8f18ee0029daf99d891edf0f23dac1bb4d67dbc365bdf05f32
SHA512

ac8884857c408f5de21d6db1d03efef32d3cf3f245de1eadadb27b54370f84579a2dc1d8c29e9b00122338d712c92ee9decd4bbb7c47d93015c30173380c3342
SSDEEP

384:Ro0Py0hDIZbike7K4DDY2EcUxdbEyZMhXZLKxWsBPrJqsnBCOK5kQPuF38D8hXx:RoD0Ye7PDxEXxdbEyYXpQBjMsOxkEk

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
2a02cbd61397fb1c25a83f5ab4d3e97e_JaffaCakes118
unpack001/out.upx

Files

2a02cbd61397fb1c25a83f5ab4d3e97e_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 60KB - Virtual size: 58KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ