C:\Progetti\GlobalConsultant\TTemplate\Release\TTemplate.pdb
Behavioral task
behavioral1
Sample
ac0ad88fd269a571819e18a752eb95be_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
ac0ad88fd269a571819e18a752eb95be_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
ac0ad88fd269a571819e18a752eb95be_JaffaCakes118
-
Size
81KB
-
MD5
ac0ad88fd269a571819e18a752eb95be
-
SHA1
e837868a1ac1cc0cac951f47bd9c64ed9fc5d1c4
-
SHA256
1bd4730c0278577c1fec10e6d102fb9d6933ca9c0cb1973ffb7e30021c3a7222
-
SHA512
3c91c40a8638fefa11d251827ca7ee81e3fb45f49a808e9e2c02e0881228911689ec5ffb33bed3b0b64f5b3ccb2294c3896795fec4e389ce47ef0d43bfcc42a2
-
SSDEEP
768:KjxONYh/FcMW0TRNxURQEDqAnf9/OZU9qZU9SnUg:KjiYxFcERgRv9OpUg
Malware Config
Extracted
metasploit
encoder/shikata_ga_nai
Signatures
-
Metasploit family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ac0ad88fd269a571819e18a752eb95be_JaffaCakes118
Files
-
ac0ad88fd269a571819e18a752eb95be_JaffaCakes118.exe windows:5 windows x86 arch:x86
8221c55ede60299827f0af1827a82c27
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
Sleep
IsProcessorFeaturePresent
HeapSize
WideCharToMultiByte
HeapReAlloc
GetStringTypeW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
LoadLibraryW
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
GetCommandLineW
HeapSetInformation
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetLastError
HeapFree
CreateFileW
CloseHandle
HeapAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetProcAddress
GetModuleHandleW
ExitProcess
DecodePointer
WriteFile
GetStdHandle
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
MultiByteToWideChar
RtlUnwind
LCMapStringW
Sections
.text Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 48KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ