Behavioral task
behavioral1
Sample
8876a6cb73089b94d8eb62aa6f11251a_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
8876a6cb73089b94d8eb62aa6f11251a_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
8876a6cb73089b94d8eb62aa6f11251a_JaffaCakes118
-
Size
308KB
-
MD5
8876a6cb73089b94d8eb62aa6f11251a
-
SHA1
d50b03d2f468ddab3788e518a9dd09b1e3306671
-
SHA256
0525331a569732064dbe44e4b1aed13113902c2ca666345b797657b1505b027d
-
SHA512
74947c0c3cef4edde1cc89d781c566d0196f8693c5238c7f2b265c3b70ad44937df2144182ec54d3e37b343d0b3bc3dd5030350d632f947acf6f5f2dbc43fe82
-
SSDEEP
6144:LVtVMEpYzWhXgtxacl/c7EuIEsBfRECZL2oH+Vb5n3YSHSB:iEmWhQDl/c7EuIEEfSoHdSyB
Malware Config
Extracted
metasploit
encoder/fnstenv_mov
Signatures
-
Metasploit family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8876a6cb73089b94d8eb62aa6f11251a_JaffaCakes118
Files
-
8876a6cb73089b94d8eb62aa6f11251a_JaffaCakes118.exe windows:4 windows x86 arch:x86
4f967201370a275b4f95e797ce60672a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
user32
EmptyClipboard
OpenClipboard
VkKeyScanA
SetClipboardData
SetFocus
SetForegroundWindow
keybd_event
BlockInput
wsprintfA
ShowWindow
CloseClipboard
ole32
CoInitialize
CoCreateInstance
CoUninitialize
oleaut32
VariantClear
SysAllocString
VariantInit
SysFreeString
ws2_32
htons
inet_addr
socket
WSAStartup
closesocket
send
recv
WSACleanup
setsockopt
ioctlsocket
connect
shutdown
accept
__WSAFDIsSet
select
listen
bind
sendto
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
kernel32
GetTimeFormatA
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetLocaleInfoW
SetEndOfFile
IsBadCodePtr
SetUnhandledExceptionFilter
GetUserDefaultLCID
EnumSystemLocalesA
IsValidCodePage
IsValidLocale
FlushFileBuffers
SetStdHandle
GetStringTypeW
GetStringTypeA
SetConsoleCtrlHandler
GetFileType
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
LCMapStringW
LCMapStringA
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
HeapAlloc
GetOEMCP
GetACP
GetCPInfo
FatalAppExitA
InitializeCriticalSection
GetCurrentThread
TlsGetValue
SetLastError
TlsFree
TlsAlloc
TlsSetValue
ExitProcess
Sleep
GetTickCount
DeleteFileA
CloseHandle
CreateProcessA
OpenProcess
GetCurrentProcessId
GetLastError
CopyFileA
SetFileAttributesA
GetFileAttributesA
GetModuleFileNameA
GetModuleHandleA
GetSystemDirectoryA
WaitForSingleObject
CreateMutexA
TerminateThread
MoveFileA
GetTempPathA
CreateThread
GetLocalTime
ExitThread
WriteFile
CreateFileA
FormatMessageA
GlobalUnlock
GlobalLock
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
SetFileTime
GetFileTime
ExpandEnvironmentStringsA
ReadFile
GetExitCodeProcess
PeekNamedPipe
DuplicateHandle
GetCurrentProcess
CreatePipe
WideCharToMultiByte
MultiByteToWideChar
GetComputerNameA
GetDateFormatA
GetFileSize
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
FindNextFileA
FindFirstFileA
SetFilePointer
TerminateProcess
GetLogicalDrives
TransactNamedPipe
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetProcAddress
FreeLibrary
LoadLibraryA
GlobalAlloc
GetWindowsDirectoryA
InterlockedDecrement
lstrcpynA
lstrcmpA
lstrcpyA
lstrlenA
GetLocaleInfoA
GetVersionExA
GlobalMemoryStatus
GetSystemTime
IsBadWritePtr
IsBadReadPtr
HeapValidate
InterlockedIncrement
GetTimeZoneInformation
RtlUnwind
GetStartupInfoA
GetCommandLineA
GetVersion
DebugBreak
GetStdHandle
OutputDebugStringA
GetCurrentThreadId
Sections
.text Size: 194KB - Virtual size: 194KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 76KB - Virtual size: 402KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ