Behavioral task
behavioral1
Sample
07bb3dde48e541fa09c1577baed59f39_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
07bb3dde48e541fa09c1577baed59f39_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
07bb3dde48e541fa09c1577baed59f39_JaffaCakes118
-
Size
130KB
-
MD5
07bb3dde48e541fa09c1577baed59f39
-
SHA1
dfa3afb0d9ba0002dc476e00d3f2d1e4f07377d9
-
SHA256
c282c9b409d94c7c774056354f162d6278e60c577bdfdc1a684d58221358e002
-
SHA512
b10de1a7ea3d1fd8ab05ab95cb55d312976046a45bf6f439a440cf19f1048579bfd1c2d9ee5f656246db62001b6529322bb082eed83cf9b9969895f37e658e50
-
SSDEEP
1536:zxvCsM+SYGt71D4ROqjc5pVZUb7hDzD2etD3E4rAqhV9gHcE/8Db9MOUyZskm1Mj:FqHh/y
Malware Config
Extracted
metasploit
encoder/shikata_ga_nai
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
Metasploit family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 07bb3dde48e541fa09c1577baed59f39_JaffaCakes118
Files
-
07bb3dde48e541fa09c1577baed59f39_JaffaCakes118.exe windows:4 windows x86 arch:x86
8b58a51c1fff9c4a944265c1fe0fab74
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
ExitProcess
GetModuleHandleA
GetProcAddress
SetUnhandledExceptionFilter
msvcrt
__getmainargs
__p__environ
__p__fmode
__set_app_type
_cexit
_iob
_onexit
_setmode
atexit
signal
Sections
.text Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 119KB - Virtual size: 118KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 36B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 68B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 496B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE