Behavioral task
behavioral1
Sample
39c52ec0b1e921fa453ceff4d9e05ab7_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
39c52ec0b1e921fa453ceff4d9e05ab7_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
39c52ec0b1e921fa453ceff4d9e05ab7_JaffaCakes118
-
Size
76KB
-
MD5
39c52ec0b1e921fa453ceff4d9e05ab7
-
SHA1
55b28be16417dc8ef182febba0961c1000dc0c8b
-
SHA256
0e50e24b1bfb556bbe6ec7a9f34791006eb12d4c9590e583af9109854d9e1a1a
-
SHA512
854d55e99b906c4aaf849e18d6816788c1ff94bc9e9509b1d4a8331ccde788027400eaeccbe58e09f0537a0d90a97d4fb83d6424744cf9d5acb955d09eca5c83
-
SSDEEP
768:xXZye10G7o6/Rj6bFlvmhnoHlEnc0nK5IrhFohs2C7OoMy5fhho0K6qjxfg7cxTj:HJocRWQl4IrCs2C7Oxy5ro6qjxJhfv
Malware Config
Extracted
metasploit
encoder/fnstenv_mov
Signatures
-
Metasploit family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 39c52ec0b1e921fa453ceff4d9e05ab7_JaffaCakes118
Files
-
39c52ec0b1e921fa453ceff4d9e05ab7_JaffaCakes118.exe windows:4 windows x86 arch:x86
3d8e39add094ca0bbd5ee323b89f7590
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WaitForSingleObject
GetFileSize
FreeLibrary
LoadLibraryA
HeapFree
WinExec
lstrcmpA
lstrcpynA
HeapAlloc
GetProcessHeap
GetLastError
GetCurrentProcess
TerminateProcess
OpenProcess
Process32Next
lstrcmpiA
Process32First
CreateToolhelp32Snapshot
SetEvent
ResetEvent
GetModuleFileNameA
CreateThread
CreateEventA
OutputDebugStringW
lstrcpyW
GetSystemTime
GetCommandLineA
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
MultiByteToWideChar
CreateFileW
TransactNamedPipe
FindClose
FindNextFileA
FindFirstFileA
GetDriveTypeA
GetLogicalDriveStringsA
GetStartupInfoA
ExitProcess
SetSystemTime
OutputDebugStringA
GetModuleHandleA
GetProcAddress
Sleep
lstrcpyA
DeleteFileA
GetSystemDirectoryA
lstrlenA
lstrcatA
CreateFileA
CloseHandle
DeviceIoControl
ReadFile
SetFilePointer
OpenEventA
WriteFile
mpr
WNetCancelConnection2A
WNetAddConnection2A
ws2_32
accept
WSAGetLastError
recv
closesocket
send
htons
inet_addr
WSAStartup
WSACleanup
gethostname
gethostbyname
inet_ntoa
bind
listen
select
__WSAFDIsSet
connect
socket
iphlpapi
SendARP
rpcrt4
UuidToStringA
UuidFromStringA
user32
ShowWindow
FindWindowA
SendMessageA
wsprintfA
wvsprintfA
IsCharAlphaNumericA
advapi32
CloseServiceHandle
ControlService
OpenServiceA
OpenSCManagerA
ChangeServiceConfigA
StartServiceA
DeleteService
ChangeServiceConfig2A
CreateServiceA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegCloseKey
RegRestoreKeyA
RegOpenKeyA
QueryServiceStatus
shell32
ShellExecuteA
Sections
.text Size: 20KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 44KB - Virtual size: 71KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE