E:\vsC\cpl\Release\cpl.pdb
Behavioral task
behavioral1
Sample
f8772b9a80138cd39a71f4faac388e49_JaffaCakes118.dll
Resource
win7-20240319-en
Behavioral task
behavioral2
Sample
f8772b9a80138cd39a71f4faac388e49_JaffaCakes118.dll
Resource
win10v2004-20240412-en
General
-
Target
f8772b9a80138cd39a71f4faac388e49_JaffaCakes118
-
Size
9KB
-
MD5
f8772b9a80138cd39a71f4faac388e49
-
SHA1
407a90f3af90cb6bd8b8fa63990bd71409556da0
-
SHA256
432b4e84ec739ebeac84485407f087223331eaef24c6c7b133c353c618ccec8b
-
SHA512
86fa0352c0f14f9bbfeec86905e3c643a7e968a8a610b51c6a9229197d7d394c1c0f7b2d30467ea481f4d8b59315b891d7e419bf9dd785bda962d797e8c06fbf
-
SSDEEP
96:jQ3Zn/2CiXsLex50FaCRwIvvwF+k4s/DjiWjOr2a0cZYynqjfQaJotQPKu:c/tiXsLecRXvvrASWjOPYHjJotU
Malware Config
Extracted
metasploit
windows/download_exec
http://192.168.1.104:8892/M4yb
Signatures
-
Metasploit family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource f8772b9a80138cd39a71f4faac388e49_JaffaCakes118
Files
-
f8772b9a80138cd39a71f4faac388e49_JaffaCakes118.dll windows:6 windows x86 arch:x86
7d60fc123518bacdc2d30fbc42f3eae7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
VirtualAlloc
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
user32
MessageBoxA
vcruntime140
__std_type_info_destroy_list
memset
_except_handler4_common
api-ms-win-crt-runtime-l1-1-0
_initialize_onexit_table
_initterm
_cexit
_configure_narrow_argv
_initterm_e
_execute_onexit_table
_seh_filter_dll
_initialize_narrow_environment
Exports
Exports
CPlApplet
Sections
.text Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 916B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 248B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 320B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ