Behavioral task
behavioral1
Sample
afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
afcfdba2912e471d45cc95278ac64b90_JaffaCakes118
-
Size
76KB
-
MD5
afcfdba2912e471d45cc95278ac64b90
-
SHA1
adfc9e7a6a73c078fd30576a26010a8f291c082d
-
SHA256
cdb90f310916756a4eddf9e509f00f60faadee8134ea925e3fe4c94d0c05066a
-
SHA512
4d8362edf8bc4f4083eaa62dded3f75dfb56d4cd21fb2142c3b41f55290f05e90b08b28560d20b5d4ebdefd68fc036b29e55d5d02b3984d7a4c1169c869eb0c5
-
SSDEEP
768:CUBMqCMcwdmgZH3lpUer9DtTuSChpnc0pK5IrhFohs2C7OoMy5fhho+/Ocl2KHAz:CUBaqlGkTq4IrCs2C7Oxy5rosOlAh9Y
Malware Config
Extracted
metasploit
encoder/fnstenv_mov
Signatures
-
Metasploit family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource afcfdba2912e471d45cc95278ac64b90_JaffaCakes118
Files
-
afcfdba2912e471d45cc95278ac64b90_JaffaCakes118.exe windows:4 windows x86 arch:x86
527ea7f1aeddc31001a105fbedd37ad1
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
OutputDebugStringA
SetSystemTime
GetSystemTime
CreateProcessA
GetFileSize
FreeLibrary
LoadLibraryA
HeapFree
lstrcmpA
lstrcpynA
HeapAlloc
GetProcessHeap
GetLastError
CreateFileW
MultiByteToWideChar
GetCurrentProcess
TerminateProcess
OpenProcess
Process32Next
lstrcmpiA
Process32First
CreateToolhelp32Snapshot
SetEvent
WinExec
GetModuleFileNameA
CreateEventA
WaitForSingleObject
OpenEventA
GetCommandLineA
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
TransactNamedPipe
GetTempPathA
FindClose
FindNextFileA
FindFirstFileA
GetDriveTypeA
GetLogicalDriveStringsA
GetStartupInfoA
ExitProcess
ResetEvent
CreateThread
GetModuleHandleA
GetProcAddress
Sleep
lstrcpyA
DeleteFileA
CreateFileA
DeviceIoControl
ReadFile
CloseHandle
SetFilePointer
GetSystemDirectoryA
lstrlenA
lstrcatA
OutputDebugStringW
WriteFile
mpr
WNetAddConnection2A
WNetCancelConnection2A
ws2_32
__WSAFDIsSet
connect
select
WSAGetLastError
recv
closesocket
send
htons
inet_addr
WSAStartup
WSACleanup
gethostname
gethostbyname
inet_ntoa
listen
accept
bind
socket
iphlpapi
SendARP
rpcrt4
UuidToStringA
UuidFromStringA
user32
wvsprintfA
IsCharAlphaNumericA
ShowWindow
FindWindowA
SendMessageA
wsprintfA
advapi32
CloseServiceHandle
ControlService
OpenServiceA
OpenSCManagerA
ChangeServiceConfigA
StartServiceA
DeleteService
ChangeServiceConfig2A
CreateServiceA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
QueryServiceStatus
Sections
.text Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 44KB - Virtual size: 73KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE