C:\Users\dobut\source\repos\thing\Release\thing.pdb
Behavioral task
behavioral1
Sample
c09c939f7582f76b04acbf3379d32319_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
c09c939f7582f76b04acbf3379d32319_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
c09c939f7582f76b04acbf3379d32319_JaffaCakes118
-
Size
9KB
-
MD5
c09c939f7582f76b04acbf3379d32319
-
SHA1
8860950fdfb23279a8cb6f43b43fdc66198ec4d1
-
SHA256
f19c48a8d9dfd6621e011061ba6b0ee54f5d8376d4c39fc619b9a93464cd7f13
-
SHA512
c5cbaa41d2477e83c3456fa75681c4faf3846715422b7803140e3b6eb239015dc044260e2dab034ac2212c366ab73903ffa2d135b76f8669d9d1596a9a1a5d62
-
SSDEEP
192:s2QVF/Lr5wrCgENXw/JLfNPRogXRiBd7E5pz6j9RfCX:HsTr5wrH6XaJLEgXRKd7
Malware Config
Extracted
metasploit
encoder/shikata_ga_nai
Extracted
metasploit
windows/reverse_tcp
10.0.0.198:9012
Signatures
-
Metasploit family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c09c939f7582f76b04acbf3379d32319_JaffaCakes118
Files
-
c09c939f7582f76b04acbf3379d32319_JaffaCakes118.exe windows:6 windows x86 arch:x86
116006dc6286ded0cd1fc3e3d0d1e370
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
VirtualAlloc
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetModuleHandleW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
UnhandledExceptionFilter
vcruntime140
memset
_except_handler4_common
memcpy
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfprintf
__acrt_iob_func
__p__commode
_set_fmode
api-ms-win-crt-runtime-l1-1-0
_c_exit
_seh_filter_exe
_initialize_onexit_table
_cexit
_crt_atexit
_controlfp_s
terminate
_set_app_type
_register_thread_local_exe_atexit_callback
__p___argv
_register_onexit_function
_exit
exit
_initterm_e
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
__p___argc
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
_set_new_mode
Sections
.text Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 904B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 328B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ