Behavioral task
behavioral1
Sample
5fd602b4f1b8b0acfe014f4f9818785e_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
5fd602b4f1b8b0acfe014f4f9818785e_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
5fd602b4f1b8b0acfe014f4f9818785e_JaffaCakes118
-
Size
9KB
-
MD5
5fd602b4f1b8b0acfe014f4f9818785e
-
SHA1
b56a9f268665be8a7ab24d65f279209bdb3bd252
-
SHA256
c2a2923daa4b13a39a378d823394f2dcb2d993f8666c1afc7814786163e3bd6d
-
SHA512
6df983ee0e6acda195ecf1600bb36d66d222f6a7a1765166ea33496858354614cf26a8921ec774199b6f3b345bd1456f580e4d8f12bacb3aabf7cc137c947150
-
SSDEEP
24:etGSywxa/4zAHm0Qw0QGVRkZBTJDqu+s5Bu:6yka/oA+PQGVu/Uu+0B
Malware Config
Extracted
metasploit
encoder/shikata_ga_nai
Signatures
-
Metasploit family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5fd602b4f1b8b0acfe014f4f9818785e_JaffaCakes118
Files
-
5fd602b4f1b8b0acfe014f4f9818785e_JaffaCakes118.exe windows:4 windows x86 arch:x86
b547b1487151c8557bcbc6c24574ec6b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
ExitProcess
VirtualAlloc
Sections
.text Size: 512B - Virtual size: 100B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 128B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE