Static task
static1
Behavioral task
behavioral1
Sample
Trojan-Downloader.Win32.Obfuscated.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Trojan-Downloader.Win32.Obfuscated.exe
Resource
win10v2004-20240412-en
General
-
Target
f29a25a2b1a7e55b1c2ff5daffdae607_JaffaCakes118
-
Size
34KB
-
MD5
f29a25a2b1a7e55b1c2ff5daffdae607
-
SHA1
877eb2eb6e904035f6eda0bf65491024d092658e
-
SHA256
51ff6783f73845ca509dad1fa3258fe4c3e5f298fbbb932e4f9090012215e681
-
SHA512
376731dc791157b65db6dbafa10a00978481dc0184224fdc420cee010367e1b6ffea44ee46a582213dda2d4bdef8e6a4628a9eff9f7e2c233522c64e7a064474
-
SSDEEP
768:LaiwsWPtS3U3Y8j1rQq+XLmW0jILrHHtgfp9SafFzxzFnF9Mp:mZAUiHW8fntO9BFzxZnM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Trojan-Downloader.Win32.Obfuscated.dgo
Files
-
f29a25a2b1a7e55b1c2ff5daffdae607_JaffaCakes118.zip
-
Trojan-Downloader.Win32.Obfuscated.dgo.exe windows:4 windows x86 arch:x86
3b482786665ad7da7016fbec6f580729
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleHandleW
LoadLibraryA
Sleep
GlobalUnlock
CancelWaitableTimer
GetProcAddress
LoadLibraryW
WideCharToMultiByte
SizeofResource
ReadProcessMemory
CreateProcessW
WaitForMultipleObjects
FreeResource
GetDriveTypeW
GetCurrentThreadId
MultiByteToWideChar
FindClose
CreateFileW
FindNextFileW
InterlockedIncrement
DeleteFileW
GetTickCount
user32
LoadImageW
SetCapture
TrackPopupMenu
IsDlgButtonChecked
LoadCursorW
GetWindowDC
PostThreadMessageW
LoadIconW
GetMessageW
DefWindowProcW
SystemParametersInfoW
CreateWindowExW
SetForegroundWindow
IsWindow
GetSysColor
RedrawWindow
LoadStringW
ReleaseDC
DispatchMessageW
gdi32
GetStockObject
DeleteObject
DeleteDC
StretchBlt
CreateSolidBrush
GetDeviceCaps
SetTextColor
BitBlt
CreateRoundRectRgn
advapi32
GetUserNameW
RegCreateKeyExW
RegNotifyChangeKeyValue
LookupAccountSidW
Sections
.text Size: 48KB - Virtual size: 47KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 992B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE