2e1b3d5d24e02a39fb9ca77895c99107_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2e1b3d5d24e02a39fb9ca77895c99107_JaffaCakes118
Size

127KB
MD5

2e1b3d5d24e02a39fb9ca77895c99107
SHA1

1a9630f49e28c5bb3b96c529cc0e46bb8b18f291
SHA256

a333b7ae88064bc808a43cc54da651b1ec3d6fc62168773d6db0e5f5e2d7ab2e
SHA512

f3a9cca70067c2c43a906c604859d0b4cc701529e2a76ed0f2b947369014e38bdc0fee1455b764a0093f8952d2435fff41b0af4d0a32ff848ccdf70df335b6f4
SSDEEP

3072:Tv/3GBEWV6UZF63ZU1f5/Zs0v/qEmFL0okQgz/:Tv/3GB/MYUJ05Rs0v3+L0oW7

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
2e1b3d5d24e02a39fb9ca77895c99107_JaffaCakes118
unpack001/out.upx

Files

2e1b3d5d24e02a39fb9ca77895c99107_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 128KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 122KB - Virtual size: 124KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 232KB - Virtual size: 230KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ