Behavioral task
behavioral1
Sample
258c8503cbaefd8b7b59d81490a4d68c_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
258c8503cbaefd8b7b59d81490a4d68c_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
258c8503cbaefd8b7b59d81490a4d68c_JaffaCakes118
-
Size
84KB
-
MD5
258c8503cbaefd8b7b59d81490a4d68c
-
SHA1
f114e8ecae9dd92da9df32e06549bc8ddc89bfb9
-
SHA256
eaba03bf14493232eb1f6a3367cb9074edac1386053f1842a465aad039050ea0
-
SHA512
c900831e34804c878942a76fa0b40f7070d74472cda9aaed9298c5033285161d8e99dc91a76ef52e27ed4665532a25a242f0c3e5ac8e70879ac3ff3688bbb2c0
-
SSDEEP
1536:OYlDDrU735qP4WxIrCs2C7Oxy5ro+OSoxOlAh9Y:O6DD54WxIrccS4oHSoC09Y
Malware Config
Extracted
metasploit
encoder/fnstenv_mov
Signatures
-
Metasploit family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 258c8503cbaefd8b7b59d81490a4d68c_JaffaCakes118
Files
-
258c8503cbaefd8b7b59d81490a4d68c_JaffaCakes118.exe windows:4 windows x86 arch:x86
fcfb89eb319402e674e3f5502bd6b3c5
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetFileSize
FreeLibrary
LoadLibraryA
HeapFree
lstrcpynA
HeapAlloc
GetProcessHeap
GetLastError
CreateFileW
MultiByteToWideChar
GetCurrentProcess
TerminateProcess
Module32First
OpenProcess
Process32Next
lstrcmpiA
Process32First
CreateToolhelp32Snapshot
SetEvent
WinExec
GetModuleFileNameA
CreateEventA
GetCompressedFileSizeA
OpenEventA
CreateProcessA
lstrcmpA
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
TransactNamedPipe
GetTempPathA
FindClose
FindNextFileA
FindFirstFileA
GetDriveTypeA
GetLogicalDriveStringsA
GetStartupInfoA
ExitProcess
GetSystemTime
SetSystemTime
OutputDebugStringA
WaitForSingleObject
ResetEvent
CreateThread
GetModuleHandleA
GetProcAddress
Sleep
lstrcpyA
DeleteFileA
CreateFileA
DeviceIoControl
ReadFile
CloseHandle
SetFilePointer
GetSystemDirectoryA
lstrlenA
lstrcatA
GetCommandLineA
WriteFile
mpr
WNetCancelConnection2A
WNetAddConnection2A
ws2_32
connect
__WSAFDIsSet
WSAGetLastError
select
closesocket
send
htons
inet_addr
WSAStartup
WSACleanup
gethostname
gethostbyname
inet_ntoa
listen
recv
accept
socket
bind
iphlpapi
SendARP
rpcrt4
UuidFromStringA
UuidToStringA
user32
FindWindowA
SendMessageA
wsprintfA
IsCharAlphaNumericA
wvsprintfA
ShowWindow
advapi32
RegCloseKey
RegOpenKeyExA
CloseServiceHandle
QueryServiceStatus
ControlService
OpenServiceA
OpenSCManagerA
ChangeServiceConfigA
StartServiceA
DeleteService
ChangeServiceConfig2A
CreateServiceA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegSetValueExA
RegCreateKeyA
RegQueryValueExA
Sections
.text Size: 20KB - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 52KB - Virtual size: 82KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE