Behavioral task
behavioral1
Sample
2604f03c10155631152fbdb2cc7caaad_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2604f03c10155631152fbdb2cc7caaad_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
2604f03c10155631152fbdb2cc7caaad_JaffaCakes118
-
Size
57KB
-
MD5
2604f03c10155631152fbdb2cc7caaad
-
SHA1
bb003c9ccd18234621b4541619717173558cd3be
-
SHA256
66f3ae13e3734ae2a15d651d056f2b03ae6d620607b6c5f3e631e3f43ba90194
-
SHA512
70e8f5a931265234212b4cea76f02b2dd4e7581c3ef1b47d717342abd1208f08dff69bcd45daccce428e1cbad1d1080cc499d46a3ee9baba25ddf95c1f6d6ef7
-
SSDEEP
768:0TvgdPFxQC+nmAwfuDU1BWPJoInr/JrGGCQsqs5zPredsnbnxLyHsW6yWMLlityc:qvCFf11BWPJouZGnVZSWnEH1pLmO
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
Metasploit family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 2604f03c10155631152fbdb2cc7caaad_JaffaCakes118
Files
-
2604f03c10155631152fbdb2cc7caaad_JaffaCakes118.exe windows:4 windows x86 arch:x86
3ad563be15a1c65971f7c08d69b8a6bd
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcp71
?_Nomemory@std@@YAXXZ
user32
SetClipboardData
EmptyClipboard
wsprintfA
BlockInput
keybd_event
CloseClipboard
FindWindowA
SetFocus
ShowWindow
VkKeyScanA
OpenClipboard
SetForegroundWindow
ole32
CoInitialize
CoUninitialize
CoCreateInstance
oleaut32
VariantClear
SysFreeString
SysAllocString
VariantInit
kernel32
InterlockedDecrement
lstrcpynA
lstrcmpA
lstrcpyA
WideCharToMultiByte
GetStartupInfoA
GetWindowsDirectoryA
GetLogicalDriveStringsA
GetDriveTypeA
CreateDirectoryA
CopyFileA
ExpandEnvironmentStringsA
CreateMutexA
ReleaseMutex
lstrcmpiA
Sleep
CreateThread
GetModuleFileNameA
GetTickCount
ExitThread
LeaveCriticalSection
EnterCriticalSection
GetLastError
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetTempPathA
CloseHandle
WaitForSingleObject
ExitProcess
CreateProcessA
WriteFile
CreateFileA
LoadLibraryA
GetFileAttributesA
FreeLibrary
GetCurrentProcess
GetProcAddress
TransactNamedPipe
TerminateThread
GetLocaleInfoA
GetVersionExA
DeleteFileA
SetFileAttributesA
GetModuleHandleA
GlobalUnlock
GlobalLock
GlobalAlloc
lstrlenA
msvcr71
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_amsg_exit
_acmdln
exit
strncat
sprintf
strlen
_snprintf
rand
memset
strtok
strncpy
srand
memcpy
sscanf
strcmp
strrchr
system
strchr
strcpy
atoi
strcat
free
malloc
fopen
fread
memcmp
fclose
ftell
fseek
strtoul
_vsnprintf
??3@YAXPAX@Z
??_V@YAXPAX@Z
strstr
__CxxFrameHandler
_callnewh
_except_handler3
wcslen
__dllonexit
_onexit
_c_exit
_exit
_XcptFilter
_ismbblead
_cexit
advapi32
RegQueryValueExA
RegOpenKeyExA
OpenProcessToken
RegSetValueExA
RegCreateKeyExA
RegCloseKey
ws2_32
socket
WSAStartup
closesocket
connect
ioctlsocket
Sections
.text Size: 35KB - Virtual size: 34KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 292KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ