Static task
static1
Behavioral task
behavioral1
Sample
bws-w111.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
bws-w111.exe
Resource
win10v2004-20240611-en
General
-
Target
0853e418a3876b5ac57c34dc94acb927_JaffaCakes118
-
Size
56KB
-
MD5
0853e418a3876b5ac57c34dc94acb927
-
SHA1
02f17cd2b839aedb4461f6630861ee9c922878f6
-
SHA256
889a57173a4bfca16b9eb586917bb9dcdb16acce9e733df0343d93886c26a9ff
-
SHA512
bdf1667bca50acb89362d14af04f7789ceeaeafb829805f7c7e456c2355c39ce5a5c4008b247397997ac9aa3a3d35541a6c6ed51cb8fe99f1d49fe987474d25e
-
SSDEEP
1536:AC06eqUEZOYXXNGk4fBNbmkVRXjO4unCkJEcWR+zp:AOUY8kyBNbmkn64KVJEcWEzp
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/bws-w111.exe
Files
-
0853e418a3876b5ac57c34dc94acb927_JaffaCakes118.rar
-
brewers.nfo
-
bws-w111.exe.exe windows:4 windows x86 arch:x86
c4e415dc20169c8bc984bc9acaf759d7
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleHandleA
ExitProcess
GetWindowsDirectoryA
lstrcatA
CreateDirectoryA
DeleteFileA
RemoveDirectoryA
FindResourceA
LoadResource
LockResource
SizeofResource
CreateFileA
WriteFile
CloseHandle
OpenProcess
VirtualAllocEx
WriteProcessMemory
LoadLibraryA
GetProcAddress
CreateRemoteThread
user32
DialogBoxParamA
SetTimer
LoadBitmapA
SendDlgItemMessageA
EndDialog
FindWindowA
GetWindowThreadProcessId
GetDlgItem
SendMessageA
RegisterHotKey
ReleaseCapture
gdi32
CreateFontA
SetBkMode
SetTextColor
SetBkColor
CreateSolidBrush
GetStockObject
Sections
code Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
data Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 364KB - Virtual size: 363KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ