Behavioral task
behavioral1
Sample
e8ac9f66515fe0b801b2b1e19916fb1e_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
e8ac9f66515fe0b801b2b1e19916fb1e_JaffaCakes118
-
Size
100KB
-
MD5
e8ac9f66515fe0b801b2b1e19916fb1e
-
SHA1
616ccaa9d8e10e0e1aa48c37f66f5d24d86ebe74
-
SHA256
0ebac735b1ec8ae1026525063212a09f570d83c012577bedd5977c1d8ba8b78a
-
SHA512
e5bcf510df380876d81827f68b8d3cb432763db1a3df8d19f892ed8a584a9396bdebd46bedcc56496d53597c0887fe232f85448a464acb6a93fee102a761f588
-
SSDEEP
1536:hqp2oQrAPHVAMJkdwMX1Am6/Gu2XdoSs2SbPd/9ZK8o2rNf4cXcx84kiTMz:hqpyMJkdn6/GjXdGd/02Z4cMqiTMz
Malware Config
Extracted
gozi
Signatures
-
Gozi family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e8ac9f66515fe0b801b2b1e19916fb1e_JaffaCakes118
Files
-
e8ac9f66515fe0b801b2b1e19916fb1e_JaffaCakes118.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 13KB - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ