Behavioral task
behavioral1
Sample
f4d9060f5539834826d39c1b2348857b_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f4d9060f5539834826d39c1b2348857b_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
f4d9060f5539834826d39c1b2348857b_JaffaCakes118
-
Size
45KB
-
MD5
f4d9060f5539834826d39c1b2348857b
-
SHA1
194c27d67b2cc9f0ab85c8715f91ceb26d0dd9b7
-
SHA256
de1a56fa8f5b78c4e714bad8ed37490f411b93edda254561775f97446212288c
-
SHA512
7ee793baa861dafec08d12a2971fa9e3915998a5c84d13b53c0736970a26633aff27f62b1facd0f59ac9242d985d4589656d39f956c3770214eebb1fc86b490f
-
SSDEEP
768:rQ8eDDFt8MCGnobY3s+Aqhs/JGtpA4bOaxJZUD1RUAtGiyhyETN4oTgLElZ1C:rQ8YDFtUGoU35OGHA2q1WAUiYeoTZ
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
Metasploit family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f4d9060f5539834826d39c1b2348857b_JaffaCakes118
Files
-
f4d9060f5539834826d39c1b2348857b_JaffaCakes118.exe windows:4 windows x86 arch:x86
cc65e6be663c3571c9cd99dc044cb0a4
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
wsock32
gethostbyaddr
gethostname
socket
sendto
select
recvfrom
WSAStartup
inet_addr
gethostbyname
ioctlsocket
shutdown
closesocket
htons
setsockopt
bind
listen
advapi32
GetUserNameA
shell32
ShellExecuteExA
SHChangeNotify
iphlpapi
GetAdaptersInfo
msvcrt
fopen
__dllonexit
_onexit
_exit
_XcptFilter
exit
_acmdln
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
fseek
fread
sscanf
memcmp
_strcmpi
_except_handler3
strtok
strcspn
_vsnprintf
malloc
memcpy
free
strcat
memset
strlen
??2@YAPAXI@Z
rand
sprintf
atoi
srand
strchr
strncpy
strrchr
strcpy
strcmp
strstr
_snprintf
strncat
__getmainargs
kernel32
GetStartupInfoA
GetLogicalDriveStringsA
GetDriveTypeA
lstrcatA
CreateDirectoryA
lstrlenA
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TransactNamedPipe
GetShortPathNameA
GetEnvironmentVariableA
SetPriorityClass
SetThreadPriority
SetProcessPriorityBoost
LeaveCriticalSection
TerminateThread
CopyFileA
GetWindowsDirectoryA
GetFileTime
SetFileTime
GetFileAttributesA
TerminateProcess
GetCurrentThread
GetCurrentProcess
LocalAlloc
LocalFree
GetProcAddress
LoadLibraryA
GetLocaleInfoA
CreateMutexA
SetFileAttributesA
DeleteFileA
ReleaseMutex
ExpandEnvironmentStringsA
CreateFileA
ExitThread
WriteFile
CloseHandle
CreateProcessA
WaitForSingleObject
lstrcmpiA
GetTempPathA
CreateThread
Sleep
GetLastError
GetTickCount
OpenProcess
GetModuleHandleA
GetModuleFileNameA
ExitProcess
GetVersionExA
Sections
.text Size: 30KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 11KB - Virtual size: 354KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE