Static task
static1
Behavioral task
behavioral1
Sample
PO.exe
Resource
win7-20240704-en
General
-
Target
3b1f0c9c22dee3464fa1c05f87ca9514_JaffaCakes118
-
Size
279KB
-
MD5
3b1f0c9c22dee3464fa1c05f87ca9514
-
SHA1
3451062dd36cadfcb02288442baf82992623fd53
-
SHA256
8dc9b60a65e6e42c39a6bd504d444285f44bca22d76e12df9231c8e3af86953e
-
SHA512
3c3e0273d3860764deeeb8b3a34707c5d26a7b8e6e12755a1e9eafa08d93b781ada095ca1fec38d70186102a4e7814d47e58bc712c4c6bda165820d3560fddfd
-
SSDEEP
6144:Vi8TtDS7AVNPC0PzS19Q2Yi/7c+oMfUaLYwVA+hPoiP58ojvNH3bgA:08Z27m60bS19Wt9MTYwV1hL8ojvNH3bT
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/PO.exe
Files
-
3b1f0c9c22dee3464fa1c05f87ca9514_JaffaCakes118.zip
-
PO.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 75KB - Virtual size: 74KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ