Static task
static1
Behavioral task
behavioral1
Sample
The G-20 And IMF Reform.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
The G-20 And IMF Reform.exe
Resource
win10v2004-20241007-en
General
-
Target
3d2ec2507e39e7dd3acecd7ea2ed3baf_JaffaCakes118
-
Size
40KB
-
MD5
3d2ec2507e39e7dd3acecd7ea2ed3baf
-
SHA1
376865d1c0dc257d24fbc5e52b4b6f0769357bdb
-
SHA256
861e227350329924ac2f94b3d9006662808af3de15e95c28c3d717c0c47f43ff
-
SHA512
7b8303e0c607fdded27e447bcb616d18fd670836743918136ba2d339fa10b7337dfa106c8a2b4f8e57258344813d51baa9ca1ad1712b103a4484dd57466312d6
-
SSDEEP
768:yvzw/CPxOHD1gYeZJrIf3FgwVlXFch/nyVrF75dvbkala+3RqTHe7RUB:yLhPqDmbrIf3aulvIaMkqre7aB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/The G-20 And IMF Reform.exe
Files
-
3d2ec2507e39e7dd3acecd7ea2ed3baf_JaffaCakes118.zip
-
The G-20 And IMF Reform.exe.exe windows:4 windows x86 arch:x86
e3e81cdbdc955db65b24683e5d339271
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetProcessPriorityBoost
SetThreadPriority
GetCurrentThread
SetPriorityClass
GetCurrentProcess
lstrcatA
lstrcpyA
GetEnvironmentVariableA
GetShortPathNameA
GetModuleFileNameA
CreateProcessA
CreateDirectoryA
_lopen
GetTempPathA
CloseHandle
WriteFile
LockResource
CreateFileA
LoadResource
SizeofResource
FindResourceA
GetModuleHandleA
GetStartupInfoA
user32
LoadStringA
shell32
ShellExecuteExA
SHChangeNotify
msvcrt
_controlfp
strstr
sprintf
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
Sections
.text Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 107KB - Virtual size: 107KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ