Behavioral task
behavioral1
Sample
JaffaCakes118_924cf5ab4b8479d3aa2f10ef61acb37aee661447284b579d58e974f60266f4c7.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
JaffaCakes118_924cf5ab4b8479d3aa2f10ef61acb37aee661447284b579d58e974f60266f4c7.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_924cf5ab4b8479d3aa2f10ef61acb37aee661447284b579d58e974f60266f4c7
-
Size
7KB
-
MD5
a7c0235313828b1bb543a697fc73e241
-
SHA1
f047d74243e3c55fa4d181f172ed9ce3d7e1d335
-
SHA256
924cf5ab4b8479d3aa2f10ef61acb37aee661447284b579d58e974f60266f4c7
-
SHA512
884a5709a823b67126d3f013c8b885324a661c7478712913da41674379d7aff1b2c6a84064d1599554467a99c67d02c116349862d7cec2107b1fe4ff2a381efa
-
SSDEEP
24:eFGStrJ9u0/6j2WnZdkBQAVKHaY+gYKZq8eNDMSCvOXpmB:is0HukBQvHt+hiSD9C2kB
Malware Config
Extracted
metasploit
metasploit_stager
185.232.31.2:5899
Signatures
-
Metasploit family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_924cf5ab4b8479d3aa2f10ef61acb37aee661447284b579d58e974f60266f4c7
Files
-
JaffaCakes118_924cf5ab4b8479d3aa2f10ef61acb37aee661447284b579d58e974f60266f4c7.exe windows:4 windows x64 arch:x64
b4c6fff030479aa3b12625be67bf4914
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
VirtualAlloc
ExitProcess
Sections
.text Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 132B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hiko Size: 1024B - Virtual size: 632B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE