Behavioral task
behavioral1
Sample
fe16c30782e2b16b07d5a3a1cf9dfb8f_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
fe16c30782e2b16b07d5a3a1cf9dfb8f_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
fe16c30782e2b16b07d5a3a1cf9dfb8f_JaffaCakes118
-
Size
96KB
-
MD5
fe16c30782e2b16b07d5a3a1cf9dfb8f
-
SHA1
fd43978b856cd6d2aa628be05e1187bb0ab61c3e
-
SHA256
4dbd07ff7d73fa4a5fe54307ac26b4d1d9f1dbf4b8fb02c98f5ebce935db199c
-
SHA512
b5d55e3e06c4efd3b9df3240c8fdc36a59beb99ee8476e90d7e9239ca7f07b0dc02182e0369f6b18c28a219a03b4f1f127a8ff1b0e344fb32cbb485a0de6b24b
-
SSDEEP
1536:nLw7XVeUG864MFdPCTJo+svJaaszxBx8mfSgbSHrRHwFc5EnZdXB7XIkpOTPI1j:Lwrg+bwaaszx3xSLRHUdp74k
Malware Config
Extracted
gozi
Signatures
-
Gozi family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fe16c30782e2b16b07d5a3a1cf9dfb8f_JaffaCakes118
Files
-
fe16c30782e2b16b07d5a3a1cf9dfb8f_JaffaCakes118.exe windows:4 windows x86 arch:x86
cb258cb9001b5498b05fe8a480d12650
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LocalFileTimeToFileTime
SystemTimeToFileTime
CreateFileA
lstrcpyA
lstrlenA
GetProcAddress
CreateMutexA
LoadLibraryA
GetSystemDirectoryA
SetLastError
GetModuleFileNameA
GetLastError
ReleaseMutex
CloseHandle
SetUnhandledExceptionFilter
Sleep
DeleteFileA
GetWindowsDirectoryA
GetFileAttributesA
WritePrivateProfileStringA
RtlUnwind
RaiseException
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
HeapFree
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
WriteFile
HeapAlloc
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsGetValue
ReadFile
SetFilePointer
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
IsBadWritePtr
SetStdHandle
FlushFileBuffers
InterlockedDecrement
InterlockedIncrement
IsBadReadPtr
IsBadCodePtr
GetCPInfo
GetACP
GetOEMCP
SetEndOfFile
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
user32
wsprintfA
advapi32
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
OpenSCManagerA
CloseServiceHandle
RegSetValueExA
RegCreateKeyA
OpenServiceA
Sections
.text Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 58KB - Virtual size: 63KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ