Behavioral task
behavioral1
Sample
Patch/GOM.Encoder.1.1.0.44.Patch-JW.exe
Resource
win7-20240903-en
General
-
Target
0904644b1992483503c05324f0e33294_JaffaCakes118
-
Size
46KB
-
MD5
0904644b1992483503c05324f0e33294
-
SHA1
99edc4138d9767b492333b5681196499c357581d
-
SHA256
fc9ff724b169d62b0ce6a68834f351aa9863c0e3005f739cac271fbd71a16bef
-
SHA512
8db8ff4a56359346974b00789a2d2599e28f4b4ca9fbf8d8b171c5f4fb13904530be281509a6fb4d8423d2c200cbb40083c89dbaaf550f73e4415e487709ff45
-
SSDEEP
768:hncT+ngW8TKhQD2Cs2ia8jaF401zYxm5J4mcGXGRWEjF1nLaid5gGrWPHabnUXs8:aTNW8TSCsHehVd4mZ2LjDT5gvP6bLMTL
Malware Config
Signatures
-
resource yara_rule static1/unpack001/Patch/GOM.Encoder.1.1.0.44.Patch-JW.exe upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Patch/GOM.Encoder.1.1.0.44.Patch-JW.exe
Files
-
0904644b1992483503c05324f0e33294_JaffaCakes118.zip
-
Patch/GOM.Encoder.1.1.0.44.Patch-JW.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
UPX0 Size: - Virtual size: 152KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
UPX3 Size: 38KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ