Behavioral task
behavioral1
Sample
8ee7602179767176eb0203f6934d6d9d_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
8ee7602179767176eb0203f6934d6d9d_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
8ee7602179767176eb0203f6934d6d9d_JaffaCakes118
-
Size
502KB
-
MD5
8ee7602179767176eb0203f6934d6d9d
-
SHA1
1b4249f3e6ee4b1e9f520827e367b041fd10cbf9
-
SHA256
1d24d76ba19757075b016b3f01ec8c4c2388de06f71ce4231d2bec387047e5ec
-
SHA512
f32f57949e8ba6d9bb37f576f578c50625bb894492380e396e986643b2a36c8fe0773783536ad9f72e78f8c1ad3696e11673d31ba401513d2aa636a46782acc3
-
SSDEEP
12288:lh3rHBngg2d/YAaGYw93rbDgNqEq4ecUeMM:JngpYAaGYwprbDspNec/MM
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
Metasploit family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8ee7602179767176eb0203f6934d6d9d_JaffaCakes118
Files
-
8ee7602179767176eb0203f6934d6d9d_JaffaCakes118.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 364KB - Virtual size: 364KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ljpwjyo Size: 52KB - Virtual size: 52KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
2xhnp5po Size: 68KB - Virtual size: 68KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
svu07g4j Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE