Behavioral task
behavioral1
Sample
b6f1c159bd31859cdc96cd79b1089ea8_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
b6f1c159bd31859cdc96cd79b1089ea8_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
b6f1c159bd31859cdc96cd79b1089ea8_JaffaCakes118
-
Size
130KB
-
MD5
b6f1c159bd31859cdc96cd79b1089ea8
-
SHA1
d798570d55e0fbbe9f24b33b0d4b9df7780173b2
-
SHA256
dcd5b141b0bc42ff57b8283cbdc87a19ad55dfa1ef3e68ac2b22760e5dbaeb88
-
SHA512
899c34095e13fd0b1fb3606dff5697cef6bcbe00d25c6d280fa3baf7027ec27ac78167221d1ff63ddcbe273190b1a04255c4e05c13048162bd30079dafd2dd94
-
SSDEEP
3072:L7+HEqWzQhFZ7Ky2dPbUUcyts7G6Ih3Ex8Jmjdgw:L7krchPA5yExCmj7
Malware Config
Extracted
metasploit
encoder/fnstenv_mov
Signatures
-
Metasploit family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b6f1c159bd31859cdc96cd79b1089ea8_JaffaCakes118
Files
-
b6f1c159bd31859cdc96cd79b1089ea8_JaffaCakes118.exe windows:4 windows x86 arch:x86
59fb57ed5dd75fd2743b1f02999689ba
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
shutdown
__WSAFDIsSet
inet_ntoa
ntohl
htonl
ioctlsocket
setsockopt
bind
listen
accept
getsockname
inet_addr
gethostbyname
sendto
select
WSAStartup
WSACleanup
htons
socket
connect
send
closesocket
recv
kernel32
SetStdHandle
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
FlushFileBuffers
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
HeapSize
RaiseException
SetFilePointer
GetStringTypeA
GetStringTypeW
SetUnhandledExceptionFilter
IsBadCodePtr
GetCPInfo
GetACP
GetOEMCP
SetEndOfFile
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetEnvironmentStringsW
CreateThread
CloseHandle
CreateProcessA
ExitThread
ExitProcess
GetTempPathA
lstrcmpiA
Sleep
GetTickCount
FreeLibrary
TerminateProcess
OpenProcess
LoadLibraryA
GetProcAddress
GetVersionExA
WriteFile
CreateFileA
GetModuleHandleA
GetLastError
OpenMutexA
TerminateThread
WaitForSingleObject
GetModuleFileNameA
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
CreateEventA
ReadFile
HeapAlloc
HeapFree
GetTimeZoneInformation
GetSystemTime
GetLocalTime
RtlUnwind
GetCommandLineA
GetVersion
WideCharToMultiByte
MultiByteToWideChar
LCMapStringA
LCMapStringW
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
GetCurrentProcess
Sections
.text Size: 65KB - Virtual size: 65KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 25KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sxdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 33KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ