30d0e879305ce35ef719f21d2386ae8a_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

30d0e879305ce35ef719f21d2386ae8a_JaffaCakes118
Size

27KB
MD5

30d0e879305ce35ef719f21d2386ae8a
SHA1

7ab6cfe81a051a3bbf100d256d0fb18c42b059d3
SHA256

e49b9dcff421366be3f7457957258f12044cc9a5497e0a83549642ee771bf550
SHA512

91725e47c8c8c59cb7c65f0ca7e0dea2c60bfdcc8c9dfd5db936b459b701b62dcab96a81da32804f3aa8a78d44292d422fb67b43f1b9f30d3dd07e8b1cc79d46
SSDEEP

384:CCjixhrtggbRia6Siw86SUVnQTNAHSxs5BDq5JLVztMvtMI0ALITToN9nd6C:VKNtgUIvpwnSAkAyjdVZWtdATTo1x

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
30d0e879305ce35ef719f21d2386ae8a_JaffaCakes118
unpack001/out.upx

Files

30d0e879305ce35ef719f21d2386ae8a_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 19KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 32KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 40KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ