Behavioral task
behavioral1
Sample
JaffaCakes118_67a8b2ad678062b49559812f55237b9396e3fe89c64df435799326f10c41d463.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_67a8b2ad678062b49559812f55237b9396e3fe89c64df435799326f10c41d463.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_67a8b2ad678062b49559812f55237b9396e3fe89c64df435799326f10c41d463
-
Size
188KB
-
MD5
1e0cef787b95d9b10e3e8352fff7414d
-
SHA1
d922d411e0f701426054d896985334b111ae06da
-
SHA256
67a8b2ad678062b49559812f55237b9396e3fe89c64df435799326f10c41d463
-
SHA512
e98b654b5431ad36ceae6cecca054c14415c24ccdd4f439a21b736570d59a62a73b7553956f60f7c273706543ad23567f9e3adfec2425c1845f4829f36b43aa2
-
SSDEEP
3072:EJKUrQJvlCYOANgW4rLmheVRFOiES2Td6pNYkApG945M1CsFlgS15sP4j:t7JNXN6ISRofPd6pNYkApB+Uyx1CP
Malware Config
Extracted
formbook
tnrn
WUtb3QVzGGu1sCIG
1JbCaeCwFgFR
dIo2Tk2IABExTS28lJeQxQ==
3/XZPY7k2/dM
eomaUMuQOPmEDg==
0NS8hsTk2/dM
bq6+ChF4lkz1uWBZKg==
UoXtLR1lQ10UuRj3FzviTKYRreKt
y8pjrYJYbDFb
gqJ+x8033y2bFj/d6WUpFH3ela8=
CiI+1RlBfFtaIcLOadUpv0To7fSv
zgwXXodxl4BYA+V+ntM/
WbwaNGcBsf5f1PVQ7T4p1fg=
0M6w2/uJBQUMhyxEer+F73dZ
F9cnLRtRv+cx0fJJ3RaYSUYfiBzKp9CVxw==
2dy1FV7bWT4krlU4Wuu1yc7DltJSaA==
UzC/ImHqj7oMsyxHNZci
y1Sj7lH+5v/miDE=
aJShPYWr5v4QjfHfwVIDsVZR
QUokWlO8bZ/ukMAoHJOeVrunFQ==
k52zTJO12+pWHD+pS4JoVrunFQ==
3MLQFDatpPtQFQKcPQ==
WqOBsLMNKdOnI8bZB+LYo+E=
W2sSKjV+GZXbnrwNk/i212ZH
hpyiztgFJQXLYRIRwLMv3/w=
kRZ22CA76UpnP9G7nNE/
zFTreIvfD8slw1QR
TdFrABdEa1D1uWBZKg==
MuyBwb9nWtVb0cqTeeyw2A==
Ho9pxhOK/QIOwGtEtOLYo+E=
t/oGcbHGaa+Fq0joCS7Rd3jR2NDPxUo=
zxYzdZUVMQLmyWFaKg==
lFTYGApP8nVaEQJlAz4p1fg=
DhQesfdyDQWiGgNJIPetzw==
ffpWpcNyH0yycOjEze2YUkT1lbI=
PpT2fr8xULbTlDE=
5zoThukmQgikVn0O
H+ZvrqHYT2e5lodd5Wg=
+Uhem7cwDeq1ZgQf+RbareI=
kJSjxs4D841xEOmEjwnM3A==
47mWJ8ATxu5O
S6CsDVPF15mkdR7zB+LYo+E=
/NyuJYvP6/ZRBh9wEGlhVrunFQ==
PeIujNNHZOw19ZJ06Wg=
T49xeJYfHaqMY1m2lJeQxQ==
c0zhHQtlETyYgyhHNZci
mRp5rc1KXRr8rlwxqOLYo+E=
llrAOKHyxWY6PqKMu+asPLESeTGn
6ECWHG7t2Fn2XkIbyy6obY5/Np5PYg==
k7eb6bsrVyUGhyNHNZci
DpLsOE6Uwd1CIf9v/WA=
MftaeHndYjsSiCkH+y7GlTgTtlfbp9CVxw==
fYDdNA0i9YbPiCU=
WIplhnraEbWdaxAbteLYo+E=
QKD6ivc45EmYC/xRjMqKsvY=
/4YMKf1ffuwY86SwNQ==
ZsSqGn/Q8eI47wyYyiYgyGFW
F15rpchNO8S6yWFaKg==
L/cJjL7R7Nkg8Ze7daoo
ITBEzhy1bZW1sCIG
6WzCMnjn97mXC66Gn7aHsfY=
IPwcIcONOPmEDg==
AvjEFj9We4a1sCIG
TEDjBEPIMTCVeCBHNZci
stairsdesign.one
Signatures
-
Formbook family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_67a8b2ad678062b49559812f55237b9396e3fe89c64df435799326f10c41d463
Files
-
JaffaCakes118_67a8b2ad678062b49559812f55237b9396e3fe89c64df435799326f10c41d463.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 180KB - Virtual size: 180KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ