Behavioral task
behavioral1
Sample
443680904e6387336410454c358d85c6_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
443680904e6387336410454c358d85c6_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
443680904e6387336410454c358d85c6_JaffaCakes118
-
Size
100KB
-
MD5
443680904e6387336410454c358d85c6
-
SHA1
dd48fd763966a3905f9eb34fb68bc0a322b83ad2
-
SHA256
f3b1eb48ef5dcb9f9dc3d915449e49e906cda9728c5a3c0de9a05e4781096c1b
-
SHA512
fe16304fe0ff5ac071f83ad7b3783c6e79f693f3f449da104feab9ba0212a797cf7d768ae0220a8f27209281ead735447cf3a10e07c494b4db2a23afe4ab29ff
-
SSDEEP
1536:3zV9QkOoSufUbRwMNxDbXZGXbTVre0qJGZSOqm5Mb+KR0Nc8QsJq3:jVFOoSusbRZNxRoTjy6e0Nc8QsC
Malware Config
Extracted
metasploit
windows/shell_reverse_tcp
118.223.26.15:1337
Signatures
-
Metasploit family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 443680904e6387336410454c358d85c6_JaffaCakes118
Files
-
443680904e6387336410454c358d85c6_JaffaCakes118.exe windows:4 windows x86 arch:x86
736c683d719f1d4e98e457255f29010d
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateFileA
DeleteFileA
SetFileAttributesA
SetFilePointer
LockResource
LoadResource
lstrlenA
FindResourceA
WaitForSingleObject
CreateProcessA
GetStringTypeA
LCMapStringW
WriteFile
CloseHandle
MoveFileA
GetModuleHandleA
GetModuleFileNameA
SizeofResource
CopyFileA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
HeapDestroy
HeapCreate
VirtualFree
HeapFree
RtlUnwind
GetCPInfo
GetACP
GetOEMCP
HeapAlloc
VirtualAlloc
HeapReAlloc
GetProcAddress
LoadLibraryA
MultiByteToWideChar
LCMapStringA
GetStringTypeW
user32
wsprintfA
advapi32
RegEnumKeyExA
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegOpenKeyExA
Sections
.text Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 76KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ