kpot | be8662472e7f04fbf0e8dca18edc82ae_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

be8662472e7f04fbf0e8dca18edc82ae_JaffaCakes118
Size

76KB
MD5

be8662472e7f04fbf0e8dca18edc82ae
SHA1

8405f70e98f52df1ec82d2c7e208f3e31fff6307
SHA256

79c3d1c19ec3a29f44912ed3b00a5df682d897a73d2e99225dd13a6c62ddb8cd
SHA512

79ed6f51ee7a9ac3a555445f29c1d189c9ea146de046c1020114f157e8eaa5ec5ad9ea4579f103f099462bd0891766f72334d86823495a56324933d09e302963
SSDEEP

1536:YLgZPvfzuKdinIxY3vO/LylXm/WS7F6Pi1P+hRZIM8f:YLwxInROzWSJwqM

Score

10^/10

kpot

Malware Config

Signatures

KPOT Core Executable 1 IoCs

resource	yara_rule
sample	family_kpot

Kpot family
kpot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
be8662472e7f04fbf0e8dca18edc82ae_JaffaCakes118

Files

be8662472e7f04fbf0e8dca18edc82ae_JaffaCakes118
.exe windows:5 windows x86 arch:x86

d5aca1dc34a7682d89f8088a3ffc73c0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

wnsprintfA
StrToInt64ExA
wvnsprintfW
PathMatchSpecW
wnsprintfW

wininet

InternetCrackUrlW
InternetOpenW
InternetReadFile
InternetConnectW
HttpOpenRequestW
InternetCloseHandle
HttpSendRequestW
InternetQueryDataAvailable
InternetCrackUrlA

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

gdiplus

GdiplusShutdown
GdipGetImageEncodersSize
GdipGetImageEncoders
GdiplusStartup
GdipSaveImageToStream
GdipCreateBitmapFromHBITMAP

dnsapi

DnsFree
DnsQuery_A

crypt32

CryptUnprotectData

ws2_32

socket
WSACleanup
closesocket
inet_addr
WSAStartup
inet_ntoa
connect
gethostbyname
send
recv

urlmon

IsValidURL

ntdll

RtlGetVersion

winhttp

WinHttpCloseHandle
WinHttpOpen
WinHttpConnect
WinHttpQueryDataAvailable
WinHttpReceiveResponse
WinHttpOpenRequest
WinHttpReadData
WinHttpSendRequest

kernel32

CreateProcessW
WaitForSingleObject
VirtualFree
VirtualAlloc
VirtualProtect
GetTempFileNameW
SetFileAttributesW
GetVolumeInformationW
CreateToolhelp32Snapshot
Process32NextW
GetSystemInfo
GetLocalTime
OpenProcess
GetSystemWow64DirectoryA
GetUserDefaultLangID
GetComputerNameW
GetLocaleInfoA
GetSystemTime
FileTimeToSystemTime
SystemTimeToFileTime
GetModuleHandleA
GetLastError
WideCharToMultiByte
HeapFree
GlobalMemoryStatusEx
GetTimeZoneInformation
CopyFileW
GetPrivateProfileStringW
HeapReAlloc
HeapAlloc
GetProcessHeap
GetFileSize
GlobalLock
ReadFile
CreateFileW
GlobalUnlock
CloseHandle
GetTickCount
LocalFree
FindFirstFileW
FindClose
FindNextFileW
ExpandEnvironmentStringsW
FreeLibrary
LoadLibraryA
SetFilePointer
Sleep
CreateThread
WriteFile
ExitProcess
GetModuleFileNameW
GetEnvironmentVariableW
DeleteFileW
GetFileAttributesW
GetFileAttributesExW
GetPrivateProfileSectionNamesW

user32

GetWindowDC
ReleaseDC
GetDesktopWindow
EnumDisplayDevicesA
GetKeyboardLayoutList
EnumWindows
GetWindowTextW
PostMessageA
wsprintfA
GetSystemMetrics

gdi32

CreateCompatibleBitmap
CreateCompatibleDC
BitBlt
DeleteDC
DeleteObject
SelectObject

advapi32

RegOpenKeyExA
CredEnumerateW
RegQueryValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
GetTokenInformation
GetSidSubAuthorityCount
GetUserNameW
GetSidSubAuthority
OpenProcessToken
CreateProcessAsUserW
CredFree

shell32

ShellExecuteW
SHGetFolderPathW

ole32

GetHGlobalFromStream
CreateStreamOnHGlobal
CoCreateInstance
CoUninitialize
CoTaskMemFree
CoInitialize

oleaut32

VariantClear
SafeArrayCreateVector
SafeArrayAccessData
SafeArrayUnaccessData
SysFreeString
SysAllocString

Sections

.text
Size: 54KB - Virtual size: 54KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d5aca1dc34a7682d89f8088a3ffc73c0

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

wininet

version

gdiplus

dnsapi

crypt32

ws2_32

urlmon

ntdll

winhttp

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

Sections

.text Size: 54KB - Virtual size: 54KB

.rdata Size: 16KB - Virtual size: 16KB

.data Size: 512B - Virtual size: 6KB

.CRT Size: 512B - Virtual size: 4B

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 54KB - Virtual size: 54KB

.rdata
Size: 16KB - Virtual size: 16KB

.data
Size: 512B - Virtual size: 6KB

.CRT
Size: 512B - Virtual size: 4B

.reloc
Size: 3KB - Virtual size: 3KB