metasploit | 05432fdbbf387ee8b29564524db9c6c8_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
05432fdbbf387ee8b29564524db9c6c8_JaffaCakes118
Size 162KB
Sample240620-mtbzfatamf
SHA256 ef442ba1cf19d27558083951517ade4ca2acb6b4dc2316ac4296766fcdb9d4c5
MD5 05432fdbbf387ee8b29564524db9c6c8
SHA1 7c2a3893b5c52400c2b727371c3ad9d1073ed00b
SHA512 677ffbac5a6e50220dacaeaee9d3f9bc8f7d9eb3ec3afb8b586b661a641464e8ade1f847f916c9b12bc3ba1f8dcba1e11a524468383a138906d24ee3b3bd2980
SSDEEP 3072:N/a45O9zO1v/m+TXalBlpfDW0UqjHL/F9BRqKY5ne5cIGQNr:N/f5lZu7fDlUqjHL/F9B0KY5nfQNr
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metasploit

Malware Config

Extracted

Family

metasploit

Version

encoder/shikata_ga_nai

Signatures

Metasploit family
metasploit

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
05432fdbbf387ee8b29564524db9c6c8_JaffaCakes118

File Explorer

05432fdbbf387ee8b29564524db9c6c8_JaffaCakes118

.exe 162KB

05432fdbbf387ee8b29564524db9c6c8_JaffaCakes118

IMPHASH c7b970e94adc98925b1b7437286dfe12
SHA256 ef442ba1cf19d27558083951517ade4ca2acb6b4dc2316ac4296766fcdb9d4c5
MD5 05432fdbbf387ee8b29564524db9c6c8
SHA1 7c2a3893b5c52400c2b727371c3ad9d1073ed00b
SHA512 677ffbac5a6e50220dacaeaee9d3f9bc8f7d9eb3ec3afb8b586b661a641464e8ade1f847f916c9b12bc3ba1f8dcba1e11a524468383a138906d24ee3b3bd2980
SSDEEP 3072:N/a45O9zO1v/m+TXalBlpfDW0UqjHL/F9BRqKY5ne5cIGQNr:N/f5lZu7fDlUqjHL/F9B0KY5nfQNr
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

75840

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvcrt

_acmdln __getmainargs _initterm __setusermatherr _adjust_fdiv __p__commode __p__fmode __set_app_type _except_handler3 __dllonexit _onexit ??1type_info@@UAE@XZ _controlfp ?terminate@@YAXXZ memmove exit _c_exit _wcsicmp wcslen wcschr _CxxThrowException malloc free _vsnwprintf __CxxFrameHandler ??2@YAPAXI@Z _vsnprintf _wtoi _wsplitpath _ftol wcstoul _cexit _exit _XcptFilter ??3@YAXPAX@Z

kernel32

InterlockedIncrement InterlockedDecrement WaitForMultipleObjects CreateThread TryEnterCriticalSection Sleep CompareStringW GetTimeFormatW GetProcAddress GetSystemTimeAsFileTime TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter LocalFree GetModuleHandleA GetStartupInfoA GetSystemDirectoryW CreateProcessW GetSystemDefaultLangID lstrlenW GetLocalTime SystemTimeToFileTime ExitProcess GetTickCount GetCurrentThreadId EnterCriticalSection LeaveCriticalSection CreateMutexW OpenEventW RegisterWaitForSingleObject SetEvent WaitForSingleObject QueryPerformanceCounter ReleaseMutex CreateEventW FormatMessageW SetFilePointer SetEndOfFile CreateFileMappingW MapViewOfFile UnmapViewOfFile CompareStringA WriteFile CompareFileTime GetCurrentThread SetFileTime GlobalFree GlobalAlloc InterlockedCompareExchange HeapReAlloc WideCharToMultiByte GetDateFormatW FileTimeToSystemTime MoveFileW GetFileTime CopyFileW lstrcpynW LoadLibraryExW GetVersionExW GetModuleHandleW InitializeCriticalSection CreateFileW GetFileSize ReadFile lstrlenA MultiByteToWideChar SetLastError FindFirstFileW FindNextFileW RemoveDirectoryW FindClose DeleteFileW CreateDirectoryW SetFileAttributesW GetSystemTime GetProcessHeap HeapAlloc HeapFree lstrcmpiW GetFileAttributesW GetPrivateProfileStringW VerSetConditionMask VerifyVersionInfoW GetCommandLineW LoadLibraryA CloseHandle ProcessIdToSessionId GetCurrentProcessId GetLastError DeleteCriticalSection FreeLibrary UnregisterWaitEx

gdi32

TextOutW CreateSolidBrush GetTextExtentPoint32W BitBlt SetBkColor CreateCompatibleDC SetStretchBltMode StretchBlt DeleteDC SetBkMode SetTextColor SelectObject DeleteObject GetStockObject CreateFontIndirectW GetObjectW GetCurrentObject

user32

PostMessageW EndDialog LoadCursorW LoadAcceleratorsW CharLowerA CharUpperA RegisterClassExW SetWindowLongW GetWindowTextLengthW GetWindowTextW GetPropW SetPropW CheckDlgButton LoadStringW CheckRadioButton IsDlgButtonChecked UpdateWindow GetKeyState DrawEdge EqualRect RemovePropW OffsetRect CopyRect GetDesktopWindow IsWindow SetWindowTextW SendMessageW CreateDialogParamW BeginPaint EndPaint SetWindowPos GetSystemMenu EnableMenuItem TranslateAcceleratorW CallNextHookEx GetDlgCtrlID GetSysColor GetSysColorBrush MessageBoxW GetWindowRect MapWindowPoints ReleaseDC GetDlgItem EnableWindow GetDC DrawFocusRect GetWindowLongW DrawTextW GetFocus GetCapture ReleaseCapture GetParent GetClientRect FillRect SetCursor ScreenToClient PtInRect CallWindowProcW CreateCursor InvalidateRect DestroyCursor SetRectEmpty DestroyMenu CreatePopupMenu AppendMenuW CreateWindowExW ShowWindow SetTimer PeekMessageW MsgWaitForMultipleObjectsEx TranslateMessage DispatchMessageW DestroyWindow PostQuitMessage SetWindowsHookExW DefWindowProcW GetCursorPos SetForegroundWindow TrackPopupMenu SetActiveWindow SetFocus DialogBoxParamW KillTimer LoadImageW GetSystemMetrics CharNextW SetCapture

shell32

Shell_NotifyIconW ShellExecuteW SHGetFolderPathW

ole32

CoCreateInstance CoInitializeEx CoUninitialize

oleaut32

SafeArrayDestroy SysReAllocString SysFreeString SysStringLen SysStringByteLen SysAllocStringByteLen SafeArrayCreate SafeArrayAccessData SysAllocString SafeArrayUnaccessData VariantClear SafeArrayGetUBound VariantInit SafeArrayGetElement

urlmon

CreateURLMoniker

comctl32

InitCommonControlsEx

wtsapi32

WTSFreeMemory WTSQuerySessionInformationW

advapi32

LookupPrivilegeValueW RegQueryValueExA RegOpenKeyExA ConvertStringSecurityDescriptorToSecurityDescriptorW GetSecurityDescriptorOwner GetSecurityDescriptorDacl SetNamedSecurityInfoW OpenProcessToken QueryServiceStatus AdjustTokenPrivileges RegOpenKeyW RegQueryValueExW RegCreateKeyExW RegSetValueExW RegOpenKeyExW OpenSCManagerW OpenServiceW CloseServiceHandle RegCloseKey

shlwapi

StrStrW StrChrW StrRChrW PathIsRootW PathIsUNCW PathStripToRootW PathIsRelativeW StrToIntW PathFindFileNameW

advpack

ExtractFiles

wintrust

WTHelperGetProvCertFromChain WTHelperGetProvSignerFromChain WTHelperProvDataFromStateData WinVerifyTrust

crypt32

CryptHashPublicKeyInfo CertGetCertificateContextProperty