Behavioral task
behavioral1
Sample
964b6585e41cb3d7c969a851db15e2b9_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
964b6585e41cb3d7c969a851db15e2b9_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
964b6585e41cb3d7c969a851db15e2b9_JaffaCakes118
-
Size
45KB
-
MD5
964b6585e41cb3d7c969a851db15e2b9
-
SHA1
962cf84e6dc5c0c447f31dbaef6e0b3722bf5397
-
SHA256
c739c1b91a636982a8dd8b23a37acbea637a66f98da1f44e4d8f563df6ff14cc
-
SHA512
e9cc75656e963d2f1b719dc035e6442cb4219d4d29ffdeab46ce4ea5319f37235b150a2f8eb75eefd893bb70dbd22435dac82775f388fca6d6bceb738a41c7fd
-
SSDEEP
768:5on04nJUcetU5PfHlbfMyhjllFXzKZsUavVrmYHuBXtewRQqkOkl+gm0LElGi:5o7UcetEPfFbMy/rUaYYHuB8N5l+9b
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
Metasploit family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 964b6585e41cb3d7c969a851db15e2b9_JaffaCakes118
Files
-
964b6585e41cb3d7c969a851db15e2b9_JaffaCakes118.exe windows:4 windows x86 arch:x86
79d0e747080788211b97bf5d35a20374
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
strtok
_acmdln
exit
_XcptFilter
_exit
_onexit
__dllonexit
memcmp
strncat
_strcmpi
_except_handler3
??3@YAXPAX@Z
_vsnprintf
malloc
memcpy
free
strcat
memset
??2@YAPAXI@Z
atoi
srand
_snprintf
strchr
strrchr
strcpy
rand
strstr
sprintf
sscanf
strlen
strcmp
strncpy
_controlfp
kernel32
GetStartupInfoA
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TransactNamedPipe
CreateMutexA
DeleteFileA
ExpandEnvironmentStringsA
ReleaseMutex
GetShortPathNameA
GetEnvironmentVariableA
SetPriorityClass
SetThreadPriority
SetProcessPriorityBoost
SetFileAttributesA
CopyFileA
GetWindowsDirectoryA
GetFileTime
SetFileTime
GetFileAttributesA
TerminateThread
OpenProcess
TerminateProcess
GetCurrentThread
GetCurrentProcess
GetProcAddress
LoadLibraryA
GetLocaleInfoA
GetModuleHandleA
GetVersionExA
CreateFileA
WriteFile
CreateProcessA
lstrcmpiA
CreateThread
GetTempPathA
GetLastError
Sleep
ExitThread
ExitProcess
CloseHandle
WaitForSingleObject
GetTickCount
GetModuleFileNameA
ws2_32
htons
closesocket
shutdown
inet_addr
gethostbyname
WSAStartup
connect
socket
gethostname
iphlpapi
GetAdaptersInfo
shell32
ShellExecuteExA
SHChangeNotify
Sections
.text Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 355KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 928B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ