Behavioral task
behavioral1
Sample
033a6d2b6ef4b2caf362017a163fa551_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
033a6d2b6ef4b2caf362017a163fa551_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
033a6d2b6ef4b2caf362017a163fa551_JaffaCakes118
-
Size
363KB
-
MD5
033a6d2b6ef4b2caf362017a163fa551
-
SHA1
29905c9c02facca403b1367dd892653dcbfcde19
-
SHA256
61a3c2c99ab9ce479cf37921066a4fa64f638200411789e5128821b0c366b080
-
SHA512
0c0843f55b0766a35b54c247eca5d7387f69b660a3fc28b6f6f88e1e0f4338a644746b0af8e8c90738a148cc8cfb80eaecfa0cd7af8f08fa87612adaeb76da9e
-
SSDEEP
6144:Z/L0kUoq1J19FwACAHu+UNl9/AlfEf3URNkAXehrjsNdMV26QF6L6hNfl:Z/L0kUnJ1UibUp/AlEf3sxXehrjs0RIt
Malware Config
Extracted
metasploit
encoder/fnstenv_mov
Signatures
-
Metasploit family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 033a6d2b6ef4b2caf362017a163fa551_JaffaCakes118
Files
-
033a6d2b6ef4b2caf362017a163fa551_JaffaCakes118.exe windows:4 windows x86 arch:x86
71f5ef610ac3f78f9b70802e407c8f9d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mpr
WNetAddConnection2A
ws2_32
getsockopt
ntohs
inet_ntoa
inet_addr
htons
connect
WSACleanup
WSAStartup
setsockopt
WSASocketA
bind
listen
accept
recv
closesocket
socket
send
select
__WSAFDIsSet
getsockname
ioctlsocket
kernel32
QueryPerformanceFrequency
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetLocaleInfoW
GetTimeZoneInformation
SetEndOfFile
GetUserDefaultLCID
EnumSystemLocalesA
IsValidCodePage
IsValidLocale
IsBadCodePtr
SetUnhandledExceptionFilter
GetStringTypeW
GetStringTypeA
FlushFileBuffers
SetStdHandle
GetFileType
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
ExitProcess
CloseHandle
CreateProcessA
GetModuleFileNameA
GetSystemDirectoryA
Sleep
LoadLibraryA
GetLastError
GetProcAddress
GetModuleHandleA
GetTickCount
GetComputerNameA
GetLocaleInfoA
GetVersionExA
CreateThread
DeleteFileA
OpenProcess
GetCurrentProcessId
CopyFileA
SetFileAttributesA
GetFileAttributesA
WaitForSingleObject
CreateMutexA
TerminateThread
GetTempPathA
MoveFileA
ExitThread
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
MultiByteToWideChar
ReadFile
WriteFile
TransactNamedPipe
CreateFileA
WideCharToMultiByte
TerminateProcess
DuplicateHandle
GetCurrentProcess
CreatePipe
GetTimeFormatA
GetDateFormatA
GetFileSize
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
FindNextFileA
FindFirstFileA
SetFilePointer
SetConsoleCtrlHandler
WaitForMultipleObjects
GenerateConsoleCtrlEvent
GetLocalTime
QueryPerformanceCounter
FreeLibrary
GetEnvironmentVariableW
HeapFree
HeapAlloc
GetProcessHeap
VirtualQueryEx
ReadProcessMemory
GetSystemInfo
FormatMessageA
GlobalUnlock
GlobalLock
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
SetFileTime
GetFileTime
ExpandEnvironmentStringsA
lstrcmpiA
GetExitCodeProcess
PeekNamedPipe
GetLogicalDrives
GlobalMemoryStatus
IsBadWritePtr
IsBadReadPtr
HeapValidate
RtlUnwind
InterlockedDecrement
InterlockedIncrement
GetStartupInfoA
GetCommandLineA
GetVersion
DebugBreak
GetStdHandle
OutputDebugStringA
InitializeCriticalSection
FatalAppExitA
HeapReAlloc
VirtualFree
VirtualAlloc
GetEnvironmentVariableA
HeapDestroy
HeapCreate
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetCurrentThread
GetCPInfo
GetACP
GetOEMCP
RaiseException
LCMapStringA
LCMapStringW
Sections
.text Size: 240KB - Virtual size: 239KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 87KB - Virtual size: 725KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 952B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ