Behavioral task
behavioral1
Sample
a2d3eafb9dea0a4a40e2f8ead4f431ea_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
a2d3eafb9dea0a4a40e2f8ead4f431ea_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a2d3eafb9dea0a4a40e2f8ead4f431ea_JaffaCakes118
-
Size
1.3MB
-
MD5
a2d3eafb9dea0a4a40e2f8ead4f431ea
-
SHA1
75a0feeb6270bf1dd3e454e7730189578a469a04
-
SHA256
99ffe08b76eb4f6f3e65e2c07b113de09426a3f73e8d82e65ee6998b3a9b5bbb
-
SHA512
6550aff9fc0f19d1170d01cc514481fe44757cc9b20ddbe2efb12f9ebff401e5a48891b80e8a9045b3ee6f8368f04de618ad833d418dedfbedce71fd19459048
-
SSDEEP
24576:kJLNPdYbiAh+JLNPdYbiAhTJLNPdYbiAhTJLNPdYbiAh:2LDYiAeLDYiA3LDYiA3LDYiA
Malware Config
Extracted
gozi
Signatures
-
Gozi family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a2d3eafb9dea0a4a40e2f8ead4f431ea_JaffaCakes118
Files
-
a2d3eafb9dea0a4a40e2f8ead4f431ea_JaffaCakes118.exe windows:4 windows x86 arch:x86
09d0478591d4f788cb3e5ea416c25237
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
Sections
.WWPACK Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.zcode Size: 317KB - Virtual size: 344KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 20KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE