302a5264e070b4fd469741e11e1ed2d3_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

302a5264e070b4fd469741e11e1ed2d3_JaffaCakes118
Size

29KB
MD5

302a5264e070b4fd469741e11e1ed2d3
SHA1

637cce158cfe7c92e8f7d52d6f1c653fbd568f23
SHA256

6700e5c1f82baf94234ebb82bdfa6ae00c3fc61e00010aeda302219e2fd7937c
SHA512

6a7825646529eb0e867e4ec95ad61ed54d79e0994b7ef2c1a6c7e37e1edaf0eadd59af8e9ff123c8f127d84096f6735c9224e56e2a097e31e0cd0c7b22d3769b
SSDEEP

768:TErq6w79gryxx2/pDxaP19r6acX5IWl02xsOA08ZZwh8:Cr3Ox869mvflfTFKZO8

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
302a5264e070b4fd469741e11e1ed2d3_JaffaCakes118
unpack001/out.upx

Files

302a5264e070b4fd469741e11e1ed2d3_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 48KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 26KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.bss
Size: - Virtual size: 40B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 59KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ