Behavioral task
behavioral1
Sample
a77456a160890a26a8f7c019c2e77021_JaffaCakes118.exe
Resource
win7-20240705-en
General
-
Target
a77456a160890a26a8f7c019c2e77021_JaffaCakes118
-
Size
144KB
-
MD5
a77456a160890a26a8f7c019c2e77021
-
SHA1
7010a3ed73006729313dee850eaf019c7461e8f5
-
SHA256
37db8b987286897ed3a82ed93370279a01df428efbf0fb4dcfe4452480f537a3
-
SHA512
573a873334e9046566356f67a6b8eb0d300de8415f27bf0d549ad8c92c194e56095416abd68098ef0b9bb0f3cd27e5b9358715e58f73a79f353354c1c76557f0
-
SSDEEP
3072:9LM846TxySm5Kb/fkjEJGnYACNVFskwoNh:xcSm56/fkoJUYACLpw
Malware Config
Extracted
gozi
Signatures
-
Gozi family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a77456a160890a26a8f7c019c2e77021_JaffaCakes118
Files
-
a77456a160890a26a8f7c019c2e77021_JaffaCakes118.exe windows:4 windows x86 arch:x86
d9d821cdae1f368fb778b5a0d27d5964
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
VirtualFreeEx
WaitForSingleObject
LoadLibraryA
GetProcAddress
GetModuleHandleA
WriteProcessMemory
VirtualAllocEx
Sleep
OpenProcess
CreateToolhelp32Snapshot
CreateThread
GetLastError
CreateMutexA
CreateProcessA
SetFileAttributesA
HeapFree
WriteFile
ReadFile
HeapAlloc
GetProcessHeap
GetFileSize
CreateFileA
GetModuleFileNameA
GetTempPathA
GetShortPathNameA
MultiByteToWideChar
GetSystemInfo
GetWindowsDirectoryA
WritePrivateProfileStringA
Process32Next
Process32First
FindFirstFileA
FindClose
FindNextFileA
GetStartupInfoA
shell32
SHGetPathFromIDListA
SHGetSpecialFolderLocation
ole32
CoCreateInstance
CoUninitialize
CoInitialize
msvcrt
fopen
__CxxFrameHandler
_stricmp
__dllonexit
_onexit
fseek
_XcptFilter
exit
_acmdln
fread
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
fclose
strncpy
printf
memset
sprintf
strstr
strcmp
_except_handler3
strlen
_exit
__getmainargs
msvcp60
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
??9std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??1_Winit@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
Sections
.text Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 128KB - Virtual size: 127KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE