Static task
static1
Behavioral task
behavioral1
Sample
Order4323.img.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
Order4323.img.exe
Resource
win10v2004-20240508-en
General
-
Target
a837c5e485f17b56b3e11b27ee2b1b2e_JaffaCakes118
-
Size
21KB
-
MD5
a837c5e485f17b56b3e11b27ee2b1b2e
-
SHA1
bcd56ec148d1ba32f209705b82a7ca597507fe77
-
SHA256
2e8b8a69cbda77f55c8381d1d6ef593c9b69ca2d3ed624718b452d35cf9a698a
-
SHA512
c776d651dc97b9e499462de6517c1857bb442b3d4a3fe42fff84eb2c11f65e4c0845e1f4afc1fe157b9bbadd9487eee7c68e54585dd5958456c98c751c4780a2
-
SSDEEP
384:Vzzzt9saFgIJPISA6oREtne9Rjv1DJyGu9JR72wsQBQZNODI5:hzpaaiaIP6oREtn8doph7lsQBe
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Order4323.img.exe
Files
-
a837c5e485f17b56b3e11b27ee2b1b2e_JaffaCakes118.rar
-
Order4323.img.exe.exe windows:4 windows x86 arch:x86
db97ff6b12792525f9f8fdb570966e52
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord585
ord696
ord629
ord663
ord522
ord525
EVENT_SINK_AddRef
ord561
ord675
EVENT_SINK_Release
EVENT_SINK_QueryInterface
__vbaExceptHandler
ProcCallEngine
ord685
ord100
Sections
.text Size: 36KB - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ