Behavioral task
behavioral1
Sample
3682a136bcbf2a3e3060b173c6ccbfa6_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
3682a136bcbf2a3e3060b173c6ccbfa6_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
3682a136bcbf2a3e3060b173c6ccbfa6_JaffaCakes118
-
Size
371KB
-
MD5
3682a136bcbf2a3e3060b173c6ccbfa6
-
SHA1
3f4539d09baaf1cc5f961619e20beae797ef59ab
-
SHA256
ca240408d9d914ccf5715412eac71920c73c7a4aca7a1b5bd250957a4fde8964
-
SHA512
00c98e33d3b42a06ed3541602f83ccce76ef02f5cef3933e8cc8969b932c034dca0e5d8c2670b927178e46c1b3b38b1fd0ad20ea97e4c67c55afb43f8abb8e70
-
SSDEEP
6144:Vyx7u/C+Mo3Spxzs55aB0fbcAiM/XLlqKG3tcq3aSj0NMMK56Stssk9nrw:Vyx7u/C+B3SpxA5aijcPM/XkKotcEaSB
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
Metasploit family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3682a136bcbf2a3e3060b173c6ccbfa6_JaffaCakes118
Files
-
3682a136bcbf2a3e3060b173c6ccbfa6_JaffaCakes118.exe windows:4 windows x86 arch:x86
c15246c9d1f6fea1f5a7dbf75daa6874
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
WSASocketA
getsockopt
ntohs
inet_ntoa
connect
WSACleanup
setsockopt
ioctlsocket
bind
listen
accept
closesocket
htons
gethostbyname
WSAStartup
recv
socket
send
__WSAFDIsSet
inet_addr
select
getsockname
kernel32
FreeLibrary
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetLocaleInfoW
SetEndOfFile
GetUserDefaultLCID
EnumSystemLocalesA
IsValidCodePage
IsValidLocale
IsBadCodePtr
SetUnhandledExceptionFilter
GetStringTypeW
GetStringTypeA
FlushFileBuffers
SetStdHandle
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
LCMapStringW
LCMapStringA
ExitProcess
CloseHandle
CreateProcessA
GetModuleFileNameA
GetSystemDirectoryA
Sleep
LoadLibraryA
GetLastError
GetProcAddress
GetModuleHandleA
CreateThread
DeleteFileA
OpenProcess
GetCurrentProcessId
CopyFileA
SetFileAttributesA
GetFileAttributesA
WaitForSingleObject
CreateMutexA
GetTickCount
TerminateThread
GetTempPathA
MoveFileA
GetComputerNameA
GetLocaleInfoA
GetVersionExA
ExitThread
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
MultiByteToWideChar
ReadFile
WriteFile
TransactNamedPipe
CreateFileA
WideCharToMultiByte
TerminateProcess
DuplicateHandle
GetCurrentProcess
CreatePipe
GetTimeFormatA
GetDateFormatA
GetFileSize
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
FindNextFileA
FindFirstFileA
SetFilePointer
SetConsoleCtrlHandler
WaitForMultipleObjects
GenerateConsoleCtrlEvent
GetLocalTime
QueryPerformanceCounter
QueryPerformanceFrequency
GetEnvironmentVariableW
HeapFree
HeapAlloc
GetProcessHeap
VirtualQueryEx
ReadProcessMemory
GetSystemInfo
FormatMessageA
GlobalUnlock
GlobalLock
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
SetFileTime
GetFileTime
ExpandEnvironmentStringsA
lstrcmpiA
GetExitCodeProcess
PeekNamedPipe
GetLogicalDrives
GlobalMemoryStatus
IsBadWritePtr
IsBadReadPtr
HeapValidate
GetTimeZoneInformation
GetSystemTime
RtlUnwind
InterlockedDecrement
InterlockedIncrement
GetStartupInfoA
GetCommandLineA
GetVersion
DebugBreak
GetStdHandle
OutputDebugStringA
InitializeCriticalSection
FatalAppExitA
HeapReAlloc
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetCurrentThread
GetCPInfo
GetACP
GetOEMCP
SetHandleCount
GetFileType
RaiseException
Sections
.text Size: 240KB - Virtual size: 240KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 94KB - Virtual size: 734KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ