Static task
static1
Behavioral task
behavioral1
Sample
purchase order.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
purchase order.exe
Resource
win10v2004-20240419-en
General
-
Target
06e441f7f93dafd9c3425532db0161fb_JaffaCakes118
-
Size
452KB
-
MD5
06e441f7f93dafd9c3425532db0161fb
-
SHA1
0040475885bb35c31aa9430c307e6369e0636061
-
SHA256
7db5974f16db1242a0212877eaf417100c33251811963573ac3eff2b4864fd6f
-
SHA512
a32c56a9f35b8d83fe27291ad0c7ddb9e4e855f9eda4d167113fa485089d27c5caf81b455f18e02eff0c0a12a4d4822b8a308bcb9a6a2b13739be3e2e7722cf9
-
SSDEEP
12288:AcfdLAuFDEiGXSH20+PRYI3tlO5Fmw6G2ztsWiMjWz:AAAuFIiGCHsPSIdKF5A6WiMU
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource unpack001/purchase order.exe
Files
-
06e441f7f93dafd9c3425532db0161fb_JaffaCakes118.rar
-
purchase order.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 972KB - Virtual size: 972KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ