Behavioral task
behavioral1
Sample
JaffaCakes118_2705d06f3192137a747e9519317e058acfa8b5a9a11b8bbc7b8a46876bebacef.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_2705d06f3192137a747e9519317e058acfa8b5a9a11b8bbc7b8a46876bebacef.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_2705d06f3192137a747e9519317e058acfa8b5a9a11b8bbc7b8a46876bebacef
-
Size
1.6MB
-
MD5
2c30fb7f3c49cad84e3efe2c3b80b042
-
SHA1
ad6072508495806a6a9942c434f707e0d53a7a86
-
SHA256
2705d06f3192137a747e9519317e058acfa8b5a9a11b8bbc7b8a46876bebacef
-
SHA512
83906e7eb5b7d331f060c2e32ace90b498a92335f1e1600543e0b93609cf52b81c2324c27c479dc447a7d0883f4958fe207c2981492dbd5522a5511612a477a7
-
SSDEEP
6144:Udt56eh8ITcleMH9SDomjDBvMYos+CmDyZYIMsCIxl0J8kEMAONCgb:Udt56ehi/H9SDomjDBvMYojCmDu7eWg
Malware Config
Extracted
gcleaner
208.67.104.97
85.31.46.167
-
url_path
....!..../software.php
....!..../software.php
Signatures
-
Gcleaner family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_2705d06f3192137a747e9519317e058acfa8b5a9a11b8bbc7b8a46876bebacef
Files
-
JaffaCakes118_2705d06f3192137a747e9519317e058acfa8b5a9a11b8bbc7b8a46876bebacef.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 173KB - Virtual size: 173KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 59KB - Virtual size: 59KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ