Overview

overview

10

Static

static

10

a3037c3389...f7.exe

windows7-x64

10

a3037c3389...f7.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_a8bd6800c8c3cfdb9bd9e6061a1cb8dec93ccb35ce4404a98c84ab12c360f651

  • Size

    350KB

  • MD5

    8474adcfaeefe9f428914e4685706673

  • SHA1

    108faebbc332bf9fa3a4ea9f43f292c44e99be22

  • SHA256

    a8bd6800c8c3cfdb9bd9e6061a1cb8dec93ccb35ce4404a98c84ab12c360f651

  • SHA512

    b8ab2026d46efd07e3027bb4f7ae8e43638b829728afcdb732a052c580fdd3c8449463971a635bc0ccaba4403558590b6468caec9848e8360e3dcf47e285faf9

  • SSDEEP

    6144:xMYAgjAbLOmnRDaCwgafS/KIVuDdZBkCLIJufQL/HLF9AeGibTwUtHO:xLAgjAbLTRSzWyzIsfQ/F9AeGigUlO

Score
10/10
metasploit

Malware Config

Extracted

Family

metasploit

Version

encoder/shikata_ga_nai

Extracted

Family

metasploit

Version

windows/reverse_tcp

C2

185.63.90.137:4445

Signatures

  • Metasploit family
    metasploit
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • JaffaCakes118_a8bd6800c8c3cfdb9bd9e6061a1cb8dec93ccb35ce4404a98c84ab12c360f651
    .zip

    Password: infected

  • a3037c3389b811bc1404f719af5c8b9034c5e24710cf3a0b457d28bf1b922cf7
    .exe windows:4 windows x86 arch:x86

    5a594319a0d69dbc452e748bcf05892e


    Headers

    Imports

    Exports

    Sections