Behavioral task
behavioral1
Sample
f18e922a5903e460a0d6cfae59ca27b4_JaffaCakes118.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
f18e922a5903e460a0d6cfae59ca27b4_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
f18e922a5903e460a0d6cfae59ca27b4_JaffaCakes118
-
Size
1.0MB
-
MD5
f18e922a5903e460a0d6cfae59ca27b4
-
SHA1
9193745d818d746d710c4c40847c52e295cc218e
-
SHA256
bdd82499ce22f70a9d9e95a9a9f523c7af911706a0ba68d072a90b63f1792aab
-
SHA512
fabf313db980e95cac9688ed40c5718f06a4d3a94ee4e1ee30691d4bd5a72a9deef9a2a740d061597af270b2eba0a482e605ffee8d02ee3036f6164bdefea1d8
-
SSDEEP
12288:/ZglhUPonsXoNQTkcpqQcj6s3Rkra8t+qHeQTc:/ZglhRqJkoqQK6dXHea
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
Metasploit family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f18e922a5903e460a0d6cfae59ca27b4_JaffaCakes118
Files
-
f18e922a5903e460a0d6cfae59ca27b4_JaffaCakes118.exe windows:4 windows x86 arch:x86
bb1c04cf2259526775c8f81c59153bbb
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
inet_addr
WSACleanup
htons
connect
setsockopt
WSAStartup
socket
listen
ioctlsocket
bind
__WSAFDIsSet
send
select
closesocket
accept
recv
kernel32
MoveFileA
GetExitCodeProcess
SetEnvironmentVariableA
CompareStringW
GetLocaleInfoW
GetTimeZoneInformation
CompareStringA
IsBadCodePtr
SetUnhandledExceptionFilter
SetEndOfFile
EnumSystemLocalesA
IsValidCodePage
GetUserDefaultLCID
FlushFileBuffers
SetStdHandle
IsValidLocale
GetLastError
Sleep
CreateThread
GetModuleFileNameA
ExitThread
LeaveCriticalSection
EnterCriticalSection
GetTickCount
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetLocalTime
CloseHandle
ReadFile
SetFilePointer
GetFileSize
CreateFileA
GetSystemDirectoryA
MultiByteToWideChar
WriteFile
TransactNamedPipe
ExitProcess
CreateProcessA
FindClose
FindNextFileA
FindFirstFileA
GetTimeFormatA
GetDateFormatA
GetFileAttributesA
FileTimeToSystemTime
FileTimeToLocalFileTime
LoadLibraryA
GetProcAddress
GetModuleHandleA
FormatMessageA
GlobalUnlock
GlobalLock
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
SetFileTime
GetFileTime
ExpandEnvironmentStringsA
SetFileAttributesA
GetTempPathA
WideCharToMultiByte
GetComputerNameA
CopyFileA
GetCurrentProcess
TerminateProcess
OpenProcess
GetCurrentProcessId
WaitForSingleObject
CreateMutexA
TerminateThread
DeleteFileA
TlsFree
TlsAlloc
PeekNamedPipe
DuplicateHandle
CreatePipe
SetConsoleCtrlHandler
GetLocaleInfoA
GetVersionExA
GetLogicalDrives
WaitForMultipleObjects
GenerateConsoleCtrlEvent
QueryPerformanceCounter
QueryPerformanceFrequency
GlobalMemoryStatus
IsBadWritePtr
IsBadReadPtr
HeapValidate
InterlockedDecrement
InterlockedIncrement
RtlUnwind
GetStartupInfoA
GetCommandLineA
GetVersion
DebugBreak
GetStdHandle
OutputDebugStringA
GetCurrentThreadId
TlsSetValue
GetStringTypeA
GetStringTypeW
SetLastError
TlsGetValue
GetCurrentThread
InitializeCriticalSection
FatalAppExitA
HeapAlloc
HeapReAlloc
HeapFree
VirtualFree
VirtualAlloc
GetEnvironmentVariableA
HeapDestroy
HeapCreate
LCMapStringA
LCMapStringW
RaiseException
GetCPInfo
GetACP
GetOEMCP
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetFileType
Sections
�V Size: 216KB - Virtual size: 216KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
�& Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
�� Size: 692KB - Virtual size: 692KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
� Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 128KB - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE