b31efeddc7b1784ca1582974fab9bcb2_JaffaCakes118 | Triage

Sharing

General

Target

b31efeddc7b1784ca1582974fab9bcb2_JaffaCakes118
Size

308KB
MD5

b31efeddc7b1784ca1582974fab9bcb2
SHA1

c29ed70a495b37f9f7c87a6b21cb9cd6c2a665be
SHA256

fe6d6e3c993981a1fabb3e7f176e5c9323fcfdb2a01e50c18bd783b5a8805030
SHA512

bb0ae0aae32740260297f18d15764ce3f3d8a879b2a034cba7321bed7210340c2e798803a6595e4e0791b4d3b172189e78889b909dbcfc03c5fe9df1ae83b445
SSDEEP

6144:U54FXIbAwoeek+E/EqKHShOQVNAtu4ZFZmZFb+UDn0XdRSZw:U54IXleXEzSxLO+U7onS

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

Processes:

resource
b31efeddc7b1784ca1582974fab9bcb2_JaffaCakes118
unpack001/out.upx

Files

b31efeddc7b1784ca1582974fab9bcb2_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 332KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 280KB - Virtual size: 284KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 26KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 564KB - Virtual size: 561KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ