Behavioral task
behavioral1
Sample
JaffaCakes118_2167b6567821827427d8454b89c689fc1c04de6acbd0b656e2f4a22456c183bb.dll
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
JaffaCakes118_2167b6567821827427d8454b89c689fc1c04de6acbd0b656e2f4a22456c183bb.dll
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_2167b6567821827427d8454b89c689fc1c04de6acbd0b656e2f4a22456c183bb
-
Size
340KB
-
MD5
4d5ea2b21350256df3cbdef3f09625e1
-
SHA1
b32365f69941a31e915315bea9fcf3802de2991c
-
SHA256
2167b6567821827427d8454b89c689fc1c04de6acbd0b656e2f4a22456c183bb
-
SHA512
be818ef0e9b25a81c763de300417b5c0bc6021d344be305b370a3a2211249e5017cd27df87f11bf9acee4cc04d1c3fbf4c63b2a519d51869fd00c7a00dc9b9ca
-
SSDEEP
768:6L+hg9UfJFcv8oyIeb8EvnVBosnO1T2VOYcV0HRoJvv5:6L+yUH4zeblt6T2VOcihv
Malware Config
Extracted
gozi
Extracted
gozi
7629
jointoblog.top
linkspremium.ru
premiumlists.ru
-
base_path
/drew/
-
build
250225
-
exe_type
loader
-
extension
.jlk
-
server_id
50
Signatures
-
Gozi family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_2167b6567821827427d8454b89c689fc1c04de6acbd0b656e2f4a22456c183bb
Files
-
JaffaCakes118_2167b6567821827427d8454b89c689fc1c04de6acbd0b656e2f4a22456c183bb.dll windows:5 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Sections
.text Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 604B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: 1024B - Virtual size: 732B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 28KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ