Behavioral task
behavioral1
Sample
fd0d9a6e541102a4c3d68da28daa1cdd_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
fd0d9a6e541102a4c3d68da28daa1cdd_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
fd0d9a6e541102a4c3d68da28daa1cdd_JaffaCakes118
-
Size
34KB
-
MD5
fd0d9a6e541102a4c3d68da28daa1cdd
-
SHA1
3e45b9ffd60a932055e99e88bb484653d82b77b8
-
SHA256
aa3b1256f37f88c9fd6f19fd15e781e9875e2c2e6ce2607ecd370ffd3c6be0d4
-
SHA512
79ceff28be78765a8262a69458714b4ce8658a4f4b249e5431d71442df35e00c0c088f2549a45fee163396e23a3cb6ba57ed026963be34fe2912e3eb0ed8f3e0
-
SSDEEP
768:2SnJydEDuJufWseAIi7ooOyo8JH/Uy4C0Td4c8XPV:ZJ+EDkufWBislyo8EC2ac8N
Malware Config
Extracted
metasploit
encoder/shikata_ga_nai
Signatures
-
Metasploit family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fd0d9a6e541102a4c3d68da28daa1cdd_JaffaCakes118
Files
-
fd0d9a6e541102a4c3d68da28daa1cdd_JaffaCakes118.exe windows:4 windows x86 arch:x86
3398ff8e0629febbdc87e8158f7ab266
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
DeleteCriticalSection
EnterCriticalSection
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetProcAddress
GetStartupInfoA
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
MultiByteToWideChar
QueryPerformanceCounter
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WideCharToMultiByte
msvcrt
__dllonexit
__getmainargs
__initenv
__lconv_init
__mb_cur_max
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_cexit
_errno
_fmode
_initterm
_iob
_lock
_onexit
_unlock
_winmajor
abort
atoi
calloc
exit
fputc
free
getenv
localeconv
malloc
memcpy
setlocale
signal
strchr
strerror
strlen
strncmp
wcslen
Sections
.text Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 76B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
/4 Size: 512B - Virtual size: 204B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 3KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 52B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE