Behavioral task
behavioral1
Sample
JaffaCakes118_ed81346f6ab726e63fa8bc269ce98bc68088677257df9d081d4a2e8bbba99dcc.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_ed81346f6ab726e63fa8bc269ce98bc68088677257df9d081d4a2e8bbba99dcc.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_ed81346f6ab726e63fa8bc269ce98bc68088677257df9d081d4a2e8bbba99dcc
-
Size
188KB
-
MD5
2ff694fb47cd7daa017875bccada6a73
-
SHA1
8c0af376c30da6b1626a91b508dcca99551d65b2
-
SHA256
ed81346f6ab726e63fa8bc269ce98bc68088677257df9d081d4a2e8bbba99dcc
-
SHA512
1d58527d807da492350441601850a41ff3937d41186b6ed2176100b4f608d1c546d2f520c7fb387ece141c7eb02f9860c40d80946984001758ddfda9817f1b35
-
SSDEEP
3072:qEnaxVF38p5cFtWG0C50DiXU6VGFfCQZ+KIQ7VmBCqfHf7L46bx+:gN3A5cF3KDcpsFfXZZIqVSlf/7
Malware Config
Extracted
formbook
ubpr
ptpVli2do9q89N0=
+CSLnNslIIErRTE3deUw4HXnuqwqG4+WpQ==
5IBw+rDmyajH6J9b0Gc0
ITivu/UzzGQKCQ==
qNw+VJ7Ni+WT3pA2e/8=
6VzmXNT+607aCN1UmHCt1CjO
a+xfszZjSqdZhCfX5fXnJkJFIsuN8Ns=
DLyp4MD0xUCL6olI
kysKo0J45suL6olI
oE/eN+zqkP2lyG6YYSalUA==
Rko77gUFcKTQFA==
cW14AsnTkUOf0N6ODWjpj7S6nRI=
M9yx/sTJbmx2vzUeWQ==
SQJdWnStlfaz6J0M04r3MN8=
FLhBiiYfyjfZFOdgHU1SfmVhAGgV
nKgaME1YHRs+cHTkn4oI3ibO
vuZIRIyKMaBGiUl9iaiZxNc=
UPnZdBQV1nzxKB1N
iARlleEZxTSL6olI
w5hz+KfftpWkwox0yH7vo0GrwW7RjWVk
kaAqSHu4ptq89N0=
O3CziqftBeLwA/njKyEj
vEA50pDJigF0lGYgHjpxEKcyYwptHg==
FMKdK8wNgWCCk2VoZEOzVg==
fRoOiiZaKdVAf3NrZEOzVg==
VV7kVQYSwS7URRkgBDOkoofG
FDCembDq2Ee/zcFv74GglorM
Ew4U5xiDinh6vzUeWQ==
oa0omDh482X4
GMJJhyAr8eT0BvwvPVR/FrM2YwptHg==
EbK9tuhdalRecoo644iIkj9DIsuN8Ns=
BSB/Wnq0phHM/9QdXe0m
5OreiLv1t7DXAJ3RQor3MN8=
1FLV4uTTfGJqnGjAQIr3MN8=
7wNnVm2qnfGAtmnjKyEj
XNIl9g0/IIo6fxFOkJSlQQ==
GqKXJqeNLItAf3NrZEOzVg==
XGjNyMwsEQQQN9ONj6l/mWRgLX9yNs9o
coiiIb821K/ZFg==
ksuTEwh482X4
StAxCChpaNd3xZSQKOI=
tMQmkECyqdq89N0=
g6cSUeTcl3qs9vfjKyEj
O2ZtSFV9QaxGhjn6HPJM5sg=
UHuKZ6aqS0NMao4Q04r3MN8=
+ZT0vdwV+Fv5fxrkTg==
V3LM/5aLNw4eJOPcNNbU9LfM+SADc9lu
8nxx8Ym7kGx6vzUeWQ==
RGC8z9vhxTLC0oQtQFukoofG
p+RabJvdzT3hD/V1KjpBaK82Q+5gFA==
XwrgMNhLwTSL6olI
2wFqerDrwyfL+JA2e/8=
X+hjpg42E4cWVTr0rKz1sdc=
MWbPFJXPtRem3ZA2e/8=
ehqd5mybcsVgcWljmz6rBcU6LA==
CYv3RsGEG4kGJfzGnx5JeLIyYwptHg==
rMoZJg7CvZugrmpgZEOzVg==
cCAL2ucb8pgASPgsXw==
zdzTL77u0XzxKB1N
1tgMUk5GBVng+JA2e/8=
HZwKXN4G8En3KOClsdbtEVvkIo5yNs9o
/v9Chjqlo9q89N0=
WvwFmBkDkvGKrBAQGhgh
5hiIh5S9nP2Jn41FkJSlQQ==
gopro-one.com
Signatures
-
Formbook family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_ed81346f6ab726e63fa8bc269ce98bc68088677257df9d081d4a2e8bbba99dcc
Files
-
JaffaCakes118_ed81346f6ab726e63fa8bc269ce98bc68088677257df9d081d4a2e8bbba99dcc.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 180KB - Virtual size: 180KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ