Behavioral task
behavioral1
Sample
JaffaCakes118_6ff88b3a8c49d3dc410c43abcf46e3c6.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_6ff88b3a8c49d3dc410c43abcf46e3c6.exe
Resource
win10v2004-20250217-en
General
-
Target
JaffaCakes118_6ff88b3a8c49d3dc410c43abcf46e3c6
-
Size
32KB
-
MD5
6ff88b3a8c49d3dc410c43abcf46e3c6
-
SHA1
7f543edab67949481508589d7d0100b9355e4658
-
SHA256
2e59ddf2b3e768eb00855b1d0dcb582539cfc9293f2e98c8a89251f75d37fc1e
-
SHA512
5d7b14c56ea2c54adf7681eaff372eecc50244dbbbeca554ea1ce7b09dcc82f4f74cb6fa63fee201b7b9a09289acb55f388e3e01b958503823da69e20b3e54ac
-
SSDEEP
768:fQMt97o9Uef8q2/0GU/Fq37w1aJmOWjQz9ZXWJjkJXo/5:J989UGm8GUELw16cJjkJs
Malware Config
Extracted
gozi
Signatures
-
Gozi family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_6ff88b3a8c49d3dc410c43abcf46e3c6
Files
-
JaffaCakes118_6ff88b3a8c49d3dc410c43abcf46e3c6.exe windows:4 windows x86 arch:x86
647b2d25b4821905b4195ff7a6455b54
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleHandleA
LoadLibraryA
GetProcAddress
Sections
.text Size: 15KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_MEM_READ