Behavioral task
behavioral1
Sample
24c467943a45d8eb31ef2f2ec3bdc521_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
24c467943a45d8eb31ef2f2ec3bdc521_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
24c467943a45d8eb31ef2f2ec3bdc521_JaffaCakes118
-
Size
1.1MB
-
MD5
24c467943a45d8eb31ef2f2ec3bdc521
-
SHA1
4246e8ec6d03aab5581e88e63930c6fdff93a7c8
-
SHA256
9b35bfaeac2f647c1346184cc93b4fe5fa4a8da17e832bf9840953bca4573fde
-
SHA512
913977ab9f845f9731a8c42e6fdd1c2b3a8e5871b4074ddf228cdff45f5e80efdf84c5531f0e7a4268646b6a906dc450ce189a21249d4de9d08c55f6d72978df
-
SSDEEP
6144:q/L0kUoq1J19FwACAHu+UNl9/AlfEf3URNkAXehrjsNdMV26QF6L6Zo:q/L0kUnJ1UibUp/AlEf3sxXehrjs0R
Malware Config
Extracted
metasploit
encoder/fnstenv_mov
Signatures
-
Metasploit family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 24c467943a45d8eb31ef2f2ec3bdc521_JaffaCakes118
Files
-
24c467943a45d8eb31ef2f2ec3bdc521_JaffaCakes118.exe windows:4 windows x86 arch:x86
71f5ef610ac3f78f9b70802e407c8f9d
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
mpr
WNetAddConnection2A
ws2_32
getsockopt
ntohs
inet_ntoa
inet_addr
htons
connect
WSACleanup
WSAStartup
setsockopt
WSASocketA
bind
listen
accept
recv
closesocket
socket
send
select
__WSAFDIsSet
getsockname
ioctlsocket
kernel32
QueryPerformanceFrequency
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetLocaleInfoW
GetTimeZoneInformation
SetEndOfFile
GetUserDefaultLCID
EnumSystemLocalesA
IsValidCodePage
IsValidLocale
IsBadCodePtr
SetUnhandledExceptionFilter
GetStringTypeW
GetStringTypeA
FlushFileBuffers
SetStdHandle
GetFileType
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
ExitProcess
CloseHandle
CreateProcessA
GetModuleFileNameA
GetSystemDirectoryA
Sleep
LoadLibraryA
GetLastError
GetProcAddress
GetModuleHandleA
GetTickCount
GetComputerNameA
GetLocaleInfoA
GetVersionExA
CreateThread
DeleteFileA
OpenProcess
GetCurrentProcessId
CopyFileA
SetFileAttributesA
GetFileAttributesA
WaitForSingleObject
CreateMutexA
TerminateThread
GetTempPathA
MoveFileA
ExitThread
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
MultiByteToWideChar
ReadFile
WriteFile
TransactNamedPipe
CreateFileA
WideCharToMultiByte
TerminateProcess
DuplicateHandle
GetCurrentProcess
CreatePipe
GetTimeFormatA
GetDateFormatA
GetFileSize
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
FindNextFileA
FindFirstFileA
SetFilePointer
SetConsoleCtrlHandler
WaitForMultipleObjects
GenerateConsoleCtrlEvent
GetLocalTime
QueryPerformanceCounter
FreeLibrary
GetEnvironmentVariableW
HeapFree
HeapAlloc
GetProcessHeap
VirtualQueryEx
ReadProcessMemory
GetSystemInfo
FormatMessageA
GlobalUnlock
GlobalLock
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
SetFileTime
GetFileTime
ExpandEnvironmentStringsA
lstrcmpiA
GetExitCodeProcess
PeekNamedPipe
GetLogicalDrives
GlobalMemoryStatus
IsBadWritePtr
IsBadReadPtr
HeapValidate
RtlUnwind
InterlockedDecrement
InterlockedIncrement
GetStartupInfoA
GetCommandLineA
GetVersion
DebugBreak
GetStdHandle
OutputDebugStringA
InitializeCriticalSection
FatalAppExitA
HeapReAlloc
VirtualFree
VirtualAlloc
GetEnvironmentVariableA
HeapDestroy
HeapCreate
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetCurrentThread
GetCPInfo
GetACP
GetOEMCP
RaiseException
LCMapStringA
LCMapStringW
Sections
.text Size: 240KB - Virtual size: 240KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 728KB - Virtual size: 728KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
.adata Size: 116KB - Virtual size: 116KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE