Behavioral task
behavioral1
Sample
fbfa11407f9e213d27ddbb455702e6e9_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fbfa11407f9e213d27ddbb455702e6e9_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
fbfa11407f9e213d27ddbb455702e6e9_JaffaCakes118
-
Size
951KB
-
MD5
fbfa11407f9e213d27ddbb455702e6e9
-
SHA1
0fbeb9136aed82425595f420a173c70561f54f16
-
SHA256
f1abfc4444b595b6d0d3a7804c5cb18724e00cf8b80d2c73842bdf3e7c152b79
-
SHA512
09cf834c3bf7425d9a55107dfc9f977692bd0dca13d0d4e293bb45ae42c7d45eafd119d1c07be56f33942b45f64a2f11de32f217d19ca74c14c642b090a6be20
-
SSDEEP
12288:F69JOQaeDzmjntGmQsSSOwWjPEH8CS+K6u8uvuV:KJHTajnY+KP8uv
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
Metasploit family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fbfa11407f9e213d27ddbb455702e6e9_JaffaCakes118
Files
-
fbfa11407f9e213d27ddbb455702e6e9_JaffaCakes118.exe windows:4 windows x86 arch:x86
d7071e2290ece84239b36309ef08f03b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
WSASocketA
getsockopt
ntohs
inet_ntoa
WSACleanup
setsockopt
ioctlsocket
bind
listen
accept
WSAStartup
connect
closesocket
recv
htons
socket
send
__WSAFDIsSet
inet_addr
select
getsockname
kernel32
FindNextFileA
SetEnvironmentVariableA
CompareStringW
CompareStringA
SetEndOfFile
IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
GetStringTypeW
GetStringTypeA
FlushFileBuffers
SetStdHandle
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
LCMapStringW
LCMapStringA
HeapSize
RaiseException
GetFileType
GetStdHandle
ExitProcess
CloseHandle
CreateProcessA
GetModuleFileNameA
GetSystemDirectoryA
Sleep
LoadLibraryA
GetLastError
GetProcAddress
GetModuleHandleA
CreateThread
DeleteFileA
OpenProcess
GetCurrentProcessId
CopyFileA
SetFileAttributesA
GetFileAttributesA
WaitForSingleObject
CreateMutexA
GetTickCount
TerminateThread
GetTempPathA
MoveFileA
GetComputerNameA
GetLocaleInfoA
GetVersionExA
ExitThread
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
MultiByteToWideChar
ReadFile
WriteFile
TransactNamedPipe
CreateFileA
WideCharToMultiByte
TerminateProcess
DuplicateHandle
GetCurrentProcess
CreatePipe
GetTimeFormatA
GetDateFormatA
GetFileSize
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
FindFirstFileA
SetFilePointer
SetConsoleCtrlHandler
WaitForMultipleObjects
GenerateConsoleCtrlEvent
GetLocalTime
QueryPerformanceCounter
QueryPerformanceFrequency
FreeLibrary
GetEnvironmentVariableW
HeapFree
HeapAlloc
GetProcessHeap
VirtualQueryEx
ReadProcessMemory
GetSystemInfo
FormatMessageA
GlobalUnlock
GlobalLock
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
SetFileTime
GetFileTime
ExpandEnvironmentStringsA
lstrcmpiA
GetExitCodeProcess
PeekNamedPipe
GetLogicalDrives
GlobalMemoryStatus
HeapReAlloc
GetTimeZoneInformation
GetSystemTime
RtlUnwind
GetStartupInfoA
GetCommandLineA
GetVersion
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
GetCPInfo
GetACP
GetOEMCP
SetHandleCount
Sections
.text Size: 168KB - Virtual size: 168KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 744KB - Virtual size: 744KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sxdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ccg Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE