jaffacakes118__2d813834a358e46ba30d94a8fda8286f

General

Target
jaffacakes118__2d813834a358e46ba30d94a8fda8286f
Size 67KB
Sample260919-2fs35acc35
SHA256 c020a1cf8ab197c0545756f5f3027491b4000fe0241cadbdb6f2624325afe1f9
MD5 2d813834a358e46ba30d94a8fda8286f
SHA1 4c9284dafdfec6217b3ba5ec78468b5c7789356c
SHA512 c2cf26e4722587f1d521bfcfa3b72cf2cb539e30744f0a5ec18f04b59cc66ad310cbcbca2105f4d2242908de04b899499809c7ea0dd0d6b1c8c6ef06744d4f5e
SSDEEP 1536:bzW7kOUNqRr3gZSgNJGo9uRm2Xm79R7yCXj9fLqCKlQ37ftpRS:vWQbYQJGmam8aR7y4kCKG3LtpA
TLSH
T1006302D153B83999E53EBFB507B192B6509C3D40FF299B3EE2F059AC3841808E166336
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118__2d813834a358e46ba30d94a8fda8286f
unpack001/out.upx

File Explorer

jaffacakes118__2d813834a358e46ba30d94a8fda8286f

.exe 67KB
out.upx

.exe 373KB

jaffacakes118__2d813834a358e46ba30d94a8fda8286f

SHA256 c020a1cf8ab197c0545756f5f3027491b4000fe0241cadbdb6f2624325afe1f9
MD5 2d813834a358e46ba30d94a8fda8286f
SHA1 4c9284dafdfec6217b3ba5ec78468b5c7789356c
SHA512 c2cf26e4722587f1d521bfcfa3b72cf2cb539e30744f0a5ec18f04b59cc66ad310cbcbca2105f4d2242908de04b899499809c7ea0dd0d6b1c8c6ef06744d4f5e
SSDEEP 1536:bzW7kOUNqRr3gZSgNJGo9uRm2Xm79R7yCXj9fLqCKlQ37ftpRS:vWQbYQJGmam8aR7y4kCKG3LtpA
TLSH
T1006302D153B83999E53EBFB507B192B6509C3D40FF299B3EE2F059AC3841808E166336
MD5 SHA1 SHA512 SSDEEP TLSH

windows:9 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

3

Major OS version

9

Entry point

405968

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

out.upx

SHA256 96ad112fb7beab3f0908ec75bc9349754f6e70c5c7e8b47b639f0c230e1ff31d
MD5 3f699ebb29e7cd0b84cb56ec045fef00
SHA1 0495c8045ae2125548109b06ee4f2422db607938
SHA512 90bad0bbb543f201602407cf4602f3f4d6b032795e80a8d6ff6ad0aa9a00765db6bb66ce3b7d643db30c36d796439c149d78bd093af171ca275eee749122155b
SSDEEP 6144:7x63DQAX/tKB8ROVBCsAMTA50gMFNY3OdB8XKR+Bkdtwh/:7x63DQAvtKB8ROVoVMTA50gMFNY3OX8Z
TLSH
T19F8417C59E0FD70BD891CBF34496A76F3839B4E20F51A2A0E6B391DD78349987A36311
MD5 SHA1 SHA512 SSDEEP TLSH

windows:9 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

3

Major OS version

9

Entry point

5223

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

512B

Virtual Size

800B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_MEM_READ

Name

.rdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

360KB

Virtual Size

359KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

jaffacakes118__2d813834a358e46ba30d94a8fda8286f

generic

out.upx

generic

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118__2d813834a358e46ba30d94a8fda8286f

generic

out.upx

generic