metasploit | 20ea8ba5439258a5f92931299f07134b_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

20ea8ba5439258a5f92931299f07134b_JaffaCakes118
Size

443KB
MD5

20ea8ba5439258a5f92931299f07134b
SHA1

1e213a63c78d19e00d76ebd6f0350b6ee805b79a
SHA256

d77de554b2c461ebc053c6a732e6a167fabe576a783b65ebc460cbc8907eaf43
SHA512

b2ca1c2a9420895868cbcb038a082c059976e8946b789ed8b46ed72a6ff3752571438902398243511ebb4b2bfd68e4b2b4f294b4fd436b56a7c0d2247b2800f2
SSDEEP

6144:UQp5A6c8BmrEJBeM5SucGrMO3N9hF4fe6ByMnk/WUvsItxJNE7U8i7VCKMp56StQ:UQPA6krEJBrMarNu1n5gs0xJ2z1GB

Score

10^/10

metasploit

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

Metasploit family
metasploit

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
20ea8ba5439258a5f92931299f07134b_JaffaCakes118

Files

20ea8ba5439258a5f92931299f07134b_JaffaCakes118
.exe windows:4 windows x86 arch:x86

877004e2b592fd3f6015d3f11562b649

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

WSASocketA
getsockopt
ntohs
inet_ntoa
connect
WSACleanup
setsockopt
ioctlsocket
bind
listen
accept
closesocket
htons
gethostbyname
WSAStartup
recv
socket
send
__WSAFDIsSet
inet_addr
select
getsockname

kernel32

FreeLibrary
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetLocaleInfoW
SetEndOfFile
GetUserDefaultLCID
EnumSystemLocalesA
IsValidCodePage
IsValidLocale
IsBadCodePtr
SetUnhandledExceptionFilter
GetStringTypeW
GetStringTypeA
FlushFileBuffers
SetStdHandle
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
LCMapStringW
LCMapStringA
ExitProcess
CloseHandle
CreateProcessA
GetModuleFileNameA
GetSystemDirectoryA
Sleep
LoadLibraryA
GetLastError
GetProcAddress
GetModuleHandleA
CreateThread
DeleteFileA
OpenProcess
GetCurrentProcessId
CopyFileA
SetFileAttributesA
GetFileAttributesA
WaitForSingleObject
CreateMutexA
GetTickCount
MoveFileA
GetTempPathA
TerminateThread
GetComputerNameA
GetLocaleInfoA
GetVersionExA
ExitThread
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
MultiByteToWideChar
ReadFile
WriteFile
TransactNamedPipe
CreateFileA
WideCharToMultiByte
TerminateProcess
DuplicateHandle
GetCurrentProcess
CreatePipe
GetTimeFormatA
GetDateFormatA
GetFileSize
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
FindNextFileA
FindFirstFileA
SetFilePointer
SetConsoleCtrlHandler
WaitForMultipleObjects
GenerateConsoleCtrlEvent
GetLocalTime
QueryPerformanceCounter
QueryPerformanceFrequency
GetEnvironmentVariableW
HeapFree
HeapAlloc
GetProcessHeap
VirtualQueryEx
ReadProcessMemory
GetSystemInfo
FormatMessageA
GlobalUnlock
GlobalLock
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
SetFileTime
GetFileTime
ExpandEnvironmentStringsA
lstrcmpiA
GetExitCodeProcess
PeekNamedPipe
GetLogicalDrives
GlobalMemoryStatus
IsBadWritePtr
IsBadReadPtr
HeapValidate
GetTimeZoneInformation
GetSystemTime
RtlUnwind
InterlockedDecrement
InterlockedIncrement
GetStartupInfoA
GetCommandLineA
GetVersion
DebugBreak
GetStdHandle
OutputDebugStringA
InitializeCriticalSection
FatalAppExitA
HeapReAlloc
VirtualFree
VirtualAlloc
GetEnvironmentVariableA
HeapDestroy
HeapCreate
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetCurrentThread
GetCPInfo
GetACP
GetOEMCP
SetHandleCount
GetFileType
RaiseException

Sections

.text
Size: 303KB - Virtual size: 302KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 102KB - Virtual size: 742KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

877004e2b592fd3f6015d3f11562b649

Headers

File Characteristics

Imports

ws2_32

kernel32

Sections

.text Size: 303KB - Virtual size: 302KB

.rdata Size: 10KB - Virtual size: 9KB

.data Size: 102KB - Virtual size: 742KB

.idata Size: 4KB - Virtual size: 3KB

.reloc Size: 23KB - Virtual size: 23KB

.text
Size: 303KB - Virtual size: 302KB

.rdata
Size: 10KB - Virtual size: 9KB

.data
Size: 102KB - Virtual size: 742KB

.idata
Size: 4KB - Virtual size: 3KB

.reloc
Size: 23KB - Virtual size: 23KB