Behavioral task
behavioral1
Sample
abac2f80077d54341db8eb98f0c50398_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
abac2f80077d54341db8eb98f0c50398_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
abac2f80077d54341db8eb98f0c50398_JaffaCakes118
-
Size
11KB
-
MD5
abac2f80077d54341db8eb98f0c50398
-
SHA1
4e9a7ecbda03c9c4e72517953a4884bf694da99b
-
SHA256
e4475efa009302eb58ba77d6e99d1d253cf753d77801318efd6562f7e150fdb4
-
SHA512
fa061cc4958751529a3f476df8d9196818e005adcbcd43f0521f16b37c4debbfed3abc15707856f4a0a2afabb80585322cff537873f1949afadfd833a58a9bec
-
SSDEEP
12:VtGSGK4d//UHwGlIFWVd2UROmDvLCo9pFtMaF90exkJemvpY2GulBM5B:VtGStCOlhF9DvLdFtbP0L3pbG1B
Malware Config
Extracted
metasploit
windows/reverse_nonx_tcp
192.168.1.7:4444
Signatures
-
Metasploit family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource abac2f80077d54341db8eb98f0c50398_JaffaCakes118
Files
-
abac2f80077d54341db8eb98f0c50398_JaffaCakes118.exe windows:4 windows x86 arch:x86
f9ade0aa18f660a34a4fa23392e21838
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ExitProcess
Sections
.text Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 1B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 256B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 83B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ