Suspicious 86% Download

jaffacakes118_86ac42c521ce08d73fe34158fd1a5a578c5378210b8ad8c4a7c760941a370a59.bin

UPX packed, stripped, high entropy

Sectionless high-entropy trailing UPX ELFStatic sectionless ELF with a UPX banner
SHA-25686ac42c521ce08d73fe34158fd1a5a578c5378210b8ad8c4a7c760941a370a59

Evidence

Sectionless high-entropy trailing UPX ELF 0x0–0x140
0x07f454c46010101030000000000000000.ELF............
0x100200030001000000f079c00034000000.........y..4...
0x2000000000000000003400200003002800........4. ...(.
0x300000000001000000000000000010c000................
0x400010c000147200001472000005000000.....r...r......
0x5000100000010000004007000040970508........@...@...
⋯15 more rows
HTTP protocol version strings 0x614c–0x620c
⋯3 more rows
0x617c54202f63646e2d6367692fb7ffffff00T /cdn-cgi/.....
0x618c20485454502f312e310d0a557365722d HTTP/1.1..User-
0x619c4167656e743a20001c486f737f2ca275Agent: ..Hos.,.u
⋯7 more rows
UPX packer banner string 0x6ae3–0x6d63
⋯7 more rows
0x6b5347ebd683e90173c06197515052c30a00G.....s.a.QPR...
0x6b6324496e666f3a20546869732066696c65$Info: This file
0x6b73206973207061636b6564207769746820 is packed with
0x6b8374686520555058206578656375746162the UPX executab
0x6b936c65207061636b657220687474703a2fle packer http:/
0x6ba32f7570782e73662e6e657420240a0024/upx.sf.net $..$
0x6bb349643a2055505820332e393420436f70Id: UPX 3.94 Cop
⋯3 more rows
0x6bf37365727665642e20240a006a1d5ae81dserved. $..j.Z..
0x6c0300000050524f545f455845437c50524f...PROT_EXEC|PRO
0x6c13545f5752495445206661696c65642e0aT_WRITE failed..
0x6c23596a025b6a0458cd80b37f6a0158cd80Yj.[j.X....j.X..
⋯9 more rows
0x6cc3e7e89d3cc7062000fffffdfb3d8933ba...<.. .....=.3.
0x6cd300268d4e04e80f282f70726f632f7365.&.N...(/proc/se
0x6ce36c662f6578659badfdff005b6a5558cdlf/exe.....[jUX.
0x6cf38085c07804c604011a5e80000a538bff...x.....^...S..
⋯7 more rows
Canonical trailing UPX PackHeader magic 0x726c–0x730c
⋯7 more rows
0x72dc9224ff00000000555058210000000000.$.....UPX!.....
0x72ec555058210d0c080ae2de8ffd8df9e878UPX!...........x
0x72fcd0010000a90000001013010049060072............I..r
0x730ca0000000 ....

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.