Behavioral task
behavioral1
Sample
ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118
-
Size
56KB
-
MD5
ec6ca99af8372e9e0aac3554e5a5ea66
-
SHA1
e2308f5ee966218ebca095ff08a496f8c50ca523
-
SHA256
6d59f5b6bed43804ea372c82ab89bef56f7da0a4cd4d710c9bc24a61b020cfff
-
SHA512
ff52449480f82c05ab160ccc242aa8f466e152a87f0886bb19adc8872b00bc28733676f252af459dc4675b5c6a35d7c917c79f6b38335bec9c953ca7685d82d2
-
SSDEEP
1536:wet+aF08bJKazAy4Y7wxpU41o3eqOlAh:8U0gzAy4Yk7q3eH0
Malware Config
Extracted
metasploit
encoder/fnstenv_mov
Signatures
-
Metasploit family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118
Files
-
ec6ca99af8372e9e0aac3554e5a5ea66_JaffaCakes118.exe windows:4 windows x86 arch:x86
790d621a38111313000021d6f0f9fa8c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WaitForSingleObject
OutputDebugStringA
GetSystemDirectoryA
SetSystemTime
GetSystemTime
CreateProcessA
GetFileSize
FreeLibrary
LoadLibraryA
HeapFree
ReadFile
HeapAlloc
GetProcessHeap
GetLastError
CreateFileW
MultiByteToWideChar
GetCurrentProcess
TerminateProcess
Module32First
OpenProcess
Process32Next
lstrcmpiA
Process32First
CreateToolhelp32Snapshot
CreateThread
SetEvent
WinExec
ResetEvent
CreateEventA
OpenEventA
GetCommandLineA
lstrcmpA
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
SetFilePointer
TransactNamedPipe
FindClose
FindNextFileA
FindFirstFileA
GetDriveTypeA
GetLogicalDriveStringsA
GetStartupInfoA
ExitProcess
GetTempPathA
GetModuleHandleA
GetProcAddress
WriteFile
Sleep
lstrcpyA
DeleteFileA
lstrlenA
lstrcpynA
lstrcatA
CreateFileA
DeviceIoControl
FlushFileBuffers
CopyFileA
CloseHandle
GetModuleFileNameA
GetTickCount
mpr
WNetAddConnection2A
WNetCancelConnection2A
ws2_32
__WSAFDIsSet
connect
select
WSAGetLastError
recv
closesocket
send
htons
inet_addr
WSAStartup
WSACleanup
gethostname
gethostbyname
inet_ntoa
listen
accept
bind
socket
iphlpapi
SendARP
rpcrt4
UuidToStringA
UuidFromStringA
user32
wsprintfA
wvsprintfA
IsCharAlphaNumericA
ShowWindow
FindWindowA
SendMessageA
advapi32
CloseServiceHandle
ControlService
OpenServiceA
OpenSCManagerA
ChangeServiceConfigA
StartServiceA
DeleteService
ChangeServiceConfig2A
CreateServiceA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegCloseKey
RegSetValueExA
RegCreateKeyA
QueryServiceStatus
Sections
.text Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 24KB - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE