metasploit | 0426e2d9d31e1ec5ba1fb430157e2ade_JaffaCakes118

General

Target
0426e2d9d31e1ec5ba1fb430157e2ade_JaffaCakes118
Size 445KB
Sample240622-2ety2a1fpp
SHA256 a2e8e1f839693bb60e1a9b50987c7d4f4136a8da865d84662649dba65deed7f0
MD5 0426e2d9d31e1ec5ba1fb430157e2ade
SHA1 0e0e81f266e139c746dd16da9bb43b7bc6df588c
SHA512 0a6021022bb84d2f8f0ea186ed7ce1b7d37ca2160fb1efed20a26aed3ee6a6f94b01c642d2cd2184cb2fbe4cf63d70237e917c20ca29110059e13704693bbef0
SSDEEP 12288:cNo6BDYKR1kU+gLcnKNalKv1V0pjnGPz:cNJkU+aqzAP0Nn
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metasploit

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

Metasploit family
metasploit

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0426e2d9d31e1ec5ba1fb430157e2ade_JaffaCakes118

File Explorer

0426e2d9d31e1ec5ba1fb430157e2ade_JaffaCakes118

.exe 445KB

0426e2d9d31e1ec5ba1fb430157e2ade_JaffaCakes118

IMPHASH 877004e2b592fd3f6015d3f11562b649
SHA256 a2e8e1f839693bb60e1a9b50987c7d4f4136a8da865d84662649dba65deed7f0
MD5 0426e2d9d31e1ec5ba1fb430157e2ade
SHA1 0e0e81f266e139c746dd16da9bb43b7bc6df588c
SHA512 0a6021022bb84d2f8f0ea186ed7ce1b7d37ca2160fb1efed20a26aed3ee6a6f94b01c642d2cd2184cb2fbe4cf63d70237e917c20ca29110059e13704693bbef0
SSDEEP 12288:cNo6BDYKR1kU+gLcnKNalKv1V0pjnGPz:cNJkU+aqzAP0Nn
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

209456

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

ws2_32

WSASocketA getsockopt ntohs inet_ntoa connect WSACleanup setsockopt ioctlsocket bind listen accept closesocket htons gethostbyname WSAStartup recv socket send __WSAFDIsSet inet_addr select getsockname

kernel32

FreeLibrary SetEnvironmentVariableA CompareStringW CompareStringA GetLocaleInfoW SetEndOfFile GetUserDefaultLCID EnumSystemLocalesA IsValidCodePage IsValidLocale IsBadCodePtr SetUnhandledExceptionFilter GetStringTypeW GetStringTypeA FlushFileBuffers SetStdHandle GetEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsW FreeEnvironmentStringsA UnhandledExceptionFilter LCMapStringW LCMapStringA ExitProcess CloseHandle CreateProcessA GetModuleFileNameA GetSystemDirectoryA Sleep LoadLibraryA GetLastError GetProcAddress GetModuleHandleA CreateThread DeleteFileA OpenProcess GetCurrentProcessId CopyFileA SetFileAttributesA GetFileAttributesA WaitForSingleObject CreateMutexA GetTickCount MoveFileA GetTempPathA TerminateThread GetComputerNameA GetLocaleInfoA GetVersionExA ExitThread LeaveCriticalSection EnterCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection MultiByteToWideChar ReadFile WriteFile TransactNamedPipe CreateFileA WideCharToMultiByte TerminateProcess DuplicateHandle GetCurrentProcess CreatePipe GetTimeFormatA GetDateFormatA GetFileSize FindClose FileTimeToSystemTime FileTimeToLocalFileTime FindNextFileA FindFirstFileA SetFilePointer SetConsoleCtrlHandler WaitForMultipleObjects GenerateConsoleCtrlEvent GetLocalTime QueryPerformanceCounter QueryPerformanceFrequency GetEnvironmentVariableW HeapFree HeapAlloc GetProcessHeap VirtualQueryEx ReadProcessMemory GetSystemInfo FormatMessageA GlobalUnlock GlobalLock UnmapViewOfFile MapViewOfFile CreateFileMappingA SetFileTime GetFileTime ExpandEnvironmentStringsA lstrcmpiA GetExitCodeProcess PeekNamedPipe GetLogicalDrives GlobalMemoryStatus IsBadWritePtr IsBadReadPtr HeapValidate GetTimeZoneInformation GetSystemTime RtlUnwind InterlockedDecrement InterlockedIncrement GetStartupInfoA GetCommandLineA GetVersion DebugBreak GetStdHandle OutputDebugStringA InitializeCriticalSection FatalAppExitA HeapReAlloc VirtualFree VirtualAlloc GetEnvironmentVariableA HeapDestroy HeapCreate GetCurrentThreadId TlsSetValue TlsAlloc TlsFree SetLastError TlsGetValue GetCurrentThread GetCPInfo GetACP GetOEMCP SetHandleCount GetFileType RaiseException

Sharing