metasploit | 04462045c47dd272d10a89f78c82b573_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
04462045c47dd272d10a89f78c82b573_JaffaCakes118
Size 308KB
Sample240622-2yecpaydqf
SHA256 14d7d42379fdfd4c49cc7f70ea1b9a1a6cd17c6fc274cf920c8020dfb7010e8c
MD5 04462045c47dd272d10a89f78c82b573
SHA1 ebe93d36eaecb5bf2d9c86f1a6c623c9043fa446
SHA512 5d7c6c8af6f63703358cae123217d0daccf00c08b1830771d45ac1a43ca2a3e29ba38c9e8bd2b60e3c5c3403b6a75e436607d452de000f494c6b14d69be140fe
SSDEEP 6144:sDe2VXSMOeBiYKkiea/S3NiBXvz8Kwa/yrprmDpoljm:si2lSveBhjF30vANa/yrwl4m
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metasploit

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

Metasploit family
metasploit

File Explorer

04462045c47dd272d10a89f78c82b573_JaffaCakes118

.exe 308KB

04462045c47dd272d10a89f78c82b573_JaffaCakes118

IMPHASH 8b52fae78bfcedcf1fcce6d9943fa50a
SHA256 14d7d42379fdfd4c49cc7f70ea1b9a1a6cd17c6fc274cf920c8020dfb7010e8c
MD5 04462045c47dd272d10a89f78c82b573
SHA1 ebe93d36eaecb5bf2d9c86f1a6c623c9043fa446
SHA512 5d7c6c8af6f63703358cae123217d0daccf00c08b1830771d45ac1a43ca2a3e29ba38c9e8bd2b60e3c5c3403b6a75e436607d452de000f494c6b14d69be140fe
SSDEEP 6144:sDe2VXSMOeBiYKkiea/S3NiBXvz8Kwa/yrprmDpoljm:si2lSveBhjF30vANa/yrwl4m
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

ee:4d:1b:9f:bb:cf:50:a2:4a:14:de:6e:0e:60:e3:dc:8c:da:54:52

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 2, 2010

Minor OS version

Major OS version

Entry point

152497

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\src\Tcpview\Release\Tcpview.pdb

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

ws2_32

gethostbyname WSAGetLastError socket connect send recv closesocket WSAStartup getservbyport gethostname gethostbyaddr htons htonl ntohl ntohs

iphlpapi

SetTcpEntry GetTcpTable GetUdpTable

comctl32

ord6 ImageList_ReplaceIcon ord17 CreateToolbarEx ImageList_Create

psapi

GetModuleFileNameExA

kernel32

GetSystemTimeAsFileTime GetVersionExA ResetEvent WaitForSingleObject SetEvent LoadLibraryW OpenProcess ReadProcessMemory CreateEventA DeviceIoControl GetCurrentProcessId DuplicateHandle GetModuleFileNameA DeleteFileA GetSystemDirectoryA GetVersion GetNumberFormatA GetLocaleInfoA FormatMessageA GetTickCount TerminateProcess GlobalReAlloc GlobalUnlock GlobalLock GlobalAlloc MulDiv GetUserDefaultLangID LeaveCriticalSection EnterCriticalSection HeapFree GetProcessHeap InitializeCriticalSection ExpandEnvironmentStringsA FlushFileBuffers SetStdHandle LoadLibraryA FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetFileType SetHandleCount HeapSize GetStdHandle ExitProcess Sleep HeapDestroy HeapCreate VirtualAlloc VirtualFree QueryPerformanceCounter DeleteCriticalSection LCMapStringW MultiByteToWideChar LCMapStringA GetCurrentThread TlsFree TlsSetValue TlsAlloc TlsGetValue GetModuleHandleW IsValidCodePage GetOEMCP GetACP GetCPInfo GetConsoleMode GetConsoleCP WideCharToMultiByte WriteFile GetStartupInfoA GetCommandLineA HeapReAlloc ResumeThread CreateThread GetCurrentThreadId ExitThread HeapAlloc RtlUnwind RaiseException IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter LocalFree InterlockedDecrement InterlockedIncrement GetModuleHandleA GetProcAddress SetLastError CreateFileA FindResourceA LoadResource SizeofResource LockResource GetCurrentProcess GetLastError CloseHandle SetFilePointer WriteConsoleA QueryPerformanceFrequency WriteConsoleW InitializeCriticalSectionAndSpinCount GetStringTypeA GetStringTypeW GetCommandLineW FatalAppExitA LocalAlloc GetTimeFormatA GetDateFormatA GetUserDefaultLCID EnumSystemLocalesA IsValidLocale SetConsoleCtrlHandler FreeLibrary InterlockedExchange SetEndOfFile ReadFile GetTimeZoneInformation GetLocaleInfoW CompareStringA CompareStringW SetEnvironmentVariableA lstrlenA lstrlenW GetEnvironmentStringsW GetConsoleOutputCP

user32

GetMessageA TranslateAcceleratorA TranslateMessage DispatchMessageA RegisterClassA LoadMenuA InsertMenuA CreateMenu GetSubMenu SetMenuItemInfoA DrawMenuBar PostQuitMessage LoadStringA DialogBoxParamA EnableMenuItem TrackPopupMenu UpdateWindow DestroyIcon GetParent ChildWindowFromPoint InvalidateRect SetCapture ReleaseCapture SetWindowLongA GetWindowLongA GetCursorPos GetClientRect CreateWindowExA SetFocus CallWindowProcA GetSysColor FillRect LoadAcceleratorsA DrawIconEx InvalidateRgn SetWindowPos GetMenu CheckMenuItem SetTimer KillTimer GetWindowRect IsIconic IsZoomed OpenClipboard EmptyClipboard SetClipboardData CloseClipboard GetFocus GetDC DrawTextA ReleaseDC GetSystemMetrics MoveWindow ShowWindow ClientToScreen ScreenToClient PostMessageA DestroyWindow DefWindowProcA MessageBoxA DialogBoxIndirectParamA GetDlgItem GetSysColorBrush EndDialog SetWindowTextA LoadCursorA SetCursor InflateRect SendMessageA LoadIconA SetDlgItemTextA

gdi32

GetDeviceCaps SetMapMode StartDocA StartPage EndDoc EndPage SetBkMode SetTextColor SelectObject CreateFontIndirectA DeleteDC CreateCompatibleDC GetObjectA GetStockObject DeleteObject CreateSolidBrush GetBkColor GetTextMetricsA SetBkColor

comdlg32

ChooseFontA PrintDlgA GetSaveFileNameA

advapi32

AllocateAndInitializeSid GetTokenInformation EqualSid ConvertSidToStringSidA FlushTraceA RegQueryValueExA RegCreateKeyA RegSetValueExA RegCloseKey RegDeleteKeyA OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges FreeSid RegOpenKeyExA RegOpenKeyA

shell32

ShellExecuteExA ShellExecuteA SHGetFileInfoA

ole32

CoCreateInstance CoInitialize CoSetProxyBlanket

oleaut32

SysStringLen SysFreeString VariantClear VariantInit VariantChangeType SafeArrayGetElement SafeArrayDestroy SafeArrayUnaccessData SafeArrayAccessData SafeArrayGetUBound SafeArrayGetLBound SysAllocStringByteLen CreateErrorInfo SysStringByteLen SysAllocStringLen GetErrorInfo SetErrorInfo SysAllocString