Static task
static1
Behavioral task
behavioral1
Sample
swg1.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
swg1.exe
Resource
win10v2004-20240802-en
General
-
Target
c08e7b008b0189b65db682ce7740059a_JaffaCakes118
-
Size
23KB
-
MD5
c08e7b008b0189b65db682ce7740059a
-
SHA1
e3d5e7e7abd2e715a3dbc94ebe815db1155a8981
-
SHA256
989ee0e5fa48b34f8984acaede45102f093ced2341e1c6ef97cc1f9b74d952f3
-
SHA512
39e8d1f97e40ce4a52b35ada241a0a412c29c8c45b3d4658aa1ca60e0ae1746803a589e9dacb1cc6bda4acb8bb5d2029e0ae845a22535cb9a39501ca024f9e1b
-
SSDEEP
384:wuRNxwNxEn9IG6IKtIM7j1BUP4wJAzaOasX5JCAJwwSLnyjpBC27Gnt18moK8bwx:/3xwziT1Kl1BUP7JMaHuGAJWLNfdoTod
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/swg1.exe
Files
-
c08e7b008b0189b65db682ce7740059a_JaffaCakes118.zip
-
Info.txt
-
swg1.exe.exe .vbs windows:4 windows x86 arch:x86 polyglot
55aaa7113b114f4ddae6e2f47b7fd638
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
MethCallEngine
ord595
EVENT_SINK_AddRef
EVENT_SINK_Release
ord600
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord716
ord100
Sections
.text Size: 40KB - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ