metasploit | bd0b38dada62bd5667182ee20e18150e_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

bd0b38dada62bd5667182ee20e18150e_JaffaCakes118
Size

131KB
MD5

bd0b38dada62bd5667182ee20e18150e
SHA1

d18d0987219d1374bea2d51f8c78a72cf85d70b6
SHA256

1975c1d4807eaf6910c38af3f3dc9b76ecf49cb9c7c038c4aaf11736ce1442ce
SHA512

d04f232bbb2468b2fb78e9ad239265681d23bb60a43407f695cb98ec37b876225895e74cb86c456c244b62a08017b76866d44caff441193576eb085ca8724556
SSDEEP

3072:PSBfnQ1M5uhKSzyLTvw9ADw1BICHu3MjGwbNHs0:PSRn+05LTI9GwcCHu3MjGwbNH7

Score

10^/10

metasploit

Malware Config

Extracted

Family

metasploit

Version

encoder/shikata_ga_nai

Signatures

Metasploit family
metasploit

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bd0b38dada62bd5667182ee20e18150e_JaffaCakes118

Files

bd0b38dada62bd5667182ee20e18150e_JaffaCakes118
.exe windows:6 windows x86 arch:x86

d860c09c0634243a5a64d551b2ac13ca

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

regedit.pdb

Imports

advapi32

RegSetValueExW
RegCreateKeyW
RegEnumValueW
RegDeleteValueW
RegOpenKeyW
RegEnumKeyW
RegUnLoadKeyW
RegLoadKeyW
RegQueryInfoKeyW
RegDeleteKeyW
RegCreateKeyExW
RegRenameKey
GetSecurityDescriptorControl
RegQueryValueExW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegSetKeySecurity
GetSecurityInfo
RegConnectRegistryW
RegRestoreKeyW
RegSaveKeyW
RegOpenKeyExW
RegSetValueW
RegSetValueExA
MapGenericMask
GetNamedSecurityInfoW
SetSecurityDescriptorGroup
GetSecurityDescriptorGroup
SetSecurityDescriptorOwner
GetSecurityDescriptorOwner
SetSecurityDescriptorSacl
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
InitializeAcl
SetNamedSecurityInfoW
SetSecurityInfo
GetSecurityDescriptorSacl
GetSecurityDescriptorDacl
GetSidSubAuthority
GetSidSubAuthorityCount
LookupAccountSidW
GetInheritanceSourceW
IsValidSecurityDescriptor
RegQueryValueExA
RegFlushKey
RegCloseKey
RegOpenKeyExA

kernel32

DeleteFileW
LoadLibraryA
InterlockedCompareExchange
GetProcAddress
MulDiv
LoadLibraryW
FreeLibrary
FileTimeToLocalFileTime
FileTimeToSystemTime
GetSystemDefaultLCID
GetDateFormatW
GetTimeFormatW
SearchPathW
GetFileSize
SetFilePointer
ReadFile
MultiByteToWideChar
lstrcmpW
GetCurrentProcess
CloseHandle
HeapSetInformation
GetThreadLocale
GetModuleHandleW
RegisterApplicationRestart
ExitProcess
GetCommandLineW
GetLongPathNameW
GetProcessHeap
FormatMessageW
GetLastError
OutputDebugStringW
CreateFileW
WideCharToMultiByte
GetWindowsDirectoryW
lstrcmpiW
LocalFree
LocalAlloc
GetComputerNameW
WriteFile
GlobalAlloc
GlobalLock
DelayLoadFailureHook
InterlockedExchange
Sleep
GetStartupInfoA
SetUnhandledExceptionFilter
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
ExpandEnvironmentStringsA
GlobalUnlock
LocalReAlloc
lstrlenW

gdi32

AbortDoc
GetStockObject
GetTextExtentPoint32W
SetAbortProc
StartDocW
StartPage
SetViewportOrgEx
EndPage
EndDoc
GetDeviceCaps
DeleteDC
CreateBitmap
CreatePatternBrush
PatBlt
ExcludeClipRect
GetTextMetricsW
SelectObject
CreateFontIndirectW
SelectClipRgn
ExtTextOutW
SetTextColor
SetBkColor
DeleteObject

user32

EnableWindow
DialogBoxParamW
DrawMenuBar
InsertMenuItemW
DeleteMenu
SetCapture
GetMenu
GetMenuItemInfoW
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
IsIconic
DestroyIcon
LoadImageW
GetSysColor
SetCursor
ShowCursor
ShowWindow
SetWindowPlacement
CreateWindowExW
GetProcessDefaultLayout
LoadStringW
GetMessageW
ScreenToClient
SetCursorPos
DispatchMessageW
ClientToScreen
GetDesktopWindow
LoadIconW
PostMessageW
SetMenuDefaultItem
InsertMenuW
GetMenuItemID
CheckMenuItem
UpdateWindow
RegisterClassExW
CharNextW
GetClientRect
DestroyWindow
CreateDialogParamW
CheckDlgButton
DrawAnimatedRects
IntersectRect
SetWindowTextW
GetMessagePos
TranslateMessage
TranslateAcceleratorW
LoadAcceleratorsW
SetForegroundWindow
GetLastActivePopup
BringWindowToTop
FindWindowW
SetProcessDPIAware
GetWindow
IsDialogMessageW
PeekMessageW
CharUpperBuffW
CharUpperW
IsCharAlphaNumericW
SetTimer
BeginPaint
EndPaint
SetFocus
LoadMenuW
GetSubMenu
EnableMenuItem
IsClipboardFormatAvailable
TrackPopupMenuEx
DestroyMenu
HideCaret
MessageBeep
CharLowerW
CreateCaret
ShowCaret
GetWindowLongW
EndDialog
GetClipboardData
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
InvalidateRect
GetWindowPlacement
GetKeyState
GetDlgItemInt
GetWindowTextLengthW
CallWindowProcW
IsDlgButtonChecked
GetDlgItemTextW
ScrollWindowEx
SetCaretPos
KillTimer
ReleaseCapture
DestroyCaret
GetParent
GetWindowTextW
SendMessageW
CheckRadioButton
RegisterClipboardFormatW
LoadCursorW
ModifyMenuW
RegisterClassW
SetScrollInfo
GetDC
ReleaseDC
DefWindowProcW
SetWindowLongW
SetDlgItemTextW
SendDlgItemMessageW
GetDlgItem
GetWindowRect
GetSystemMetrics
MoveWindow
MapWindowPoints
SetWindowPos
PostQuitMessage
SetMenuItemInfoW

msvcrt

?terminate@@YAXXZ
_except_handler4_common
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_amsg_exit
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_controlfp
memmove
memcpy
atoi
memset
iswctype
wcschr
wcsncmp
wcsrchr
_wcsnicmp
_resetstkoflw
iswprint
_purecall
__getmainargs
_cexit
_vsnwprintf

shlwapi

StrChrIW
StrChrW
StrRChrW
ord388
StrToIntW
StrStrIW
ord219

comctl32

ImageList_Destroy
ord2
ord4
ImageList_ReplaceIcon
ImageList_Create
ImageList_SetBkColor
CreateStatusWindowW
ord329
ord337
ord338
ord334
ord236
ord340
InitCommonControlsEx

comdlg32

PrintDlgExW
GetOpenFileNameW
GetSaveFileNameW

shell32

SHGetStockIconInfo
DragQueryFileW
DragFinish
ShellAboutW

authz

AuthzInitializeResourceManager
AuthzInitializeContextFromSid
AuthzAccessCheck
AuthzFreeContext
AuthzFreeResourceManager

aclui

ord2

ole32

ReleaseStgMedium
CoCreateInstance
CoInitializeEx
CoUninitialize

ulib

??1OBJECT@@UAE@XZ
?Compare@OBJECT@@UBEJPBV1@@Z
??0OBJECT@@IAE@XZ
??0DSTRING@@QAE@XZ
?Initialize@WSTRING@@QAEEPBV1@KK@Z
?Strcat@WSTRING@@QAEEPBV1@@Z
?Initialize@WSTRING@@QAEEPBGK@Z
??1DSTRING@@UAE@XZ
?NewBuf@DSTRING@@UAEEK@Z
?Initialize@ARRAY@@QAEEKK@Z
??0ARRAY@@QAE@XZ
?Resize@DSTRING@@UAEEK@Z

clb

ClbAddData
ClbSetColumnWidths

ntdll

RtlAllocateHeap
RtlFreeUnicodeString
RtlCreateUnicodeString
RtlInitUnicodeString
RtlFreeHeap
RtlCmDecodeMemIoResource
RtlIoDecodeMemIoResource

uxtheme

SetWindowTheme

Sections

.text
Size: 108KB - Virtual size: 107KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 260KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

d860c09c0634243a5a64d551b2ac13ca

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

gdi32

user32

msvcrt

shlwapi

comctl32

comdlg32

shell32

authz

aclui

ole32

ulib

clb

ntdll

uxtheme

Sections

.text Size: 108KB - Virtual size: 107KB

.data Size: 1024B - Virtual size: 260KB

.rsrc Size: 13KB - Virtual size: 12KB

.reloc Size: 8KB - Virtual size: 8KB

.text
Size: 108KB - Virtual size: 107KB

.data
Size: 1024B - Virtual size: 260KB

.rsrc
Size: 13KB - Virtual size: 12KB

.reloc
Size: 8KB - Virtual size: 8KB