JaffaCakes118_b66e7f6133ca72bf1fd21edbd009d4c7 | Triage

Sharing

General

Target

JaffaCakes118_b66e7f6133ca72bf1fd21edbd009d4c7
Size

291KB
MD5

b66e7f6133ca72bf1fd21edbd009d4c7
SHA1

9bf33f24e88d2aa1d89f765556059d659d5d712d
SHA256

60c3208658b5a46442bf8304306e3bca26c85dedaa9b10b3cd6a9341f7c1cc8d
SHA512

ee2cb2c2192b77a4e12c182106e1f2d684d3bbe85f4ea4aa157302fa1640e7e4b6192b08582024e26ab27a563c62e785bac6805ab27c1d6f1a8aaa751de0356d
SSDEEP

6144:EYY0GlXNggK8b7XNwzkvytUre13HBmlDlPR+XHosS3BB06AlwZ:/Y0+CENwmre13H+RPR+XHG06Al

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_b66e7f6133ca72bf1fd21edbd009d4c7
unpack001/out.upx

Files

JaffaCakes118_b66e7f6133ca72bf1fd21edbd009d4c7
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 1.3MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 212KB - Virtual size: 216KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 78KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 80KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ