metasploit | 57287b0d09ec34cd9fa172544a60ac77_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

57287b0d09ec34cd9fa172544a60ac77_JaffaCakes118
Size

520KB
MD5

57287b0d09ec34cd9fa172544a60ac77
SHA1

83eb9bff91d6d3036e64da1bdee0f224e3b48959
SHA256

159e27e1e8ccb3d72dc7fbbe1af385e31b04490acb00ccb1b7b49f6d9cbe80aa
SHA512

8f5480cf709c3004fcb558078f07fdf55ce477b8fa2cb4a5fe54c01892cebd96d3aa69d6728d289268868ba657e81c5249805cf76b3d393098227f26c0b8e163
SSDEEP

12288:mSBzGbO4ALFGK+QT+ktCbHWy82u5PUdKu3h:IO4s+QT+kobHWy/qPQKu3

Score

10^/10

metasploit

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

Metasploit family
metasploit

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
57287b0d09ec34cd9fa172544a60ac77_JaffaCakes118

Files

57287b0d09ec34cd9fa172544a60ac77_JaffaCakes118
.exe windows:5 windows x86 arch:x86

092ca20b4e2feda3e25dbe39504603ca

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

wininet

InternetOpenUrlA
InternetReadFile
InternetOpenA
InternetCloseHandle

kernel32

CloseHandle
CreateFileA
GetTickCount
WriteFile
CreateProcessA
GetTempPathA
CreateThread
ExitProcess
SetPriorityClass
GetLocaleInfoA
MoveFileExA
GetCurrentProcess
GetCurrentThread
SetProcessPriorityBoost
GetDriveTypeA
GetFileAttributesA
GetEnvironmentVariableA
SetThreadPriority
GetShortPathNameA
GetProcAddress
LoadLibraryA
GetModuleHandleA
GetVersionExA
OpenMutexA
CreateMutexA
ReleaseMutex
GetLastError
GetCurrentProcessId
DeleteFileA
lstrlenA
FreeLibrary
CreateRemoteThread
OpenProcess
VirtualFreeEx
VirtualAllocEx
WriteProcessMemory
TerminateProcess
lstrcmpiA
WinExec
GetLogicalDriveStringsA
CreateToolhelp32Snapshot
SetEvent
CreateEventA
MultiByteToWideChar
SetLastError
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
ExitThread
EnterCriticalSection
OpenEventA
WaitForMultipleObjects
DeleteCriticalSection
WideCharToMultiByte
LocalFree
FlushFileBuffers
ReadFile
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoW
GetConsoleMode
GetConsoleCP
SetFilePointer
SetEnvironmentVariableA
CompareStringW
CompareStringA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetStringTypeW
GetStringTypeA
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
HeapSize
GetModuleFileNameA
Process32Next
SetFileAttributesA
CopyFileA
CreateDirectoryA
Sleep
GetWindowsDirectoryA
Process32First
GetComputerNameA
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
WaitForSingleObject
VirtualQuery
HeapFree
UnhandledExceptionFilter
GetStdHandle
HeapReAlloc
VirtualAlloc
VirtualFree
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
HeapAlloc
HeapCreate
GetCurrentThreadId
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
IsValidCodePage
GetOEMCP
GetACP
LCMapStringW
LCMapStringA
GetCPInfo
RtlUnwind
RaiseException
GetStartupInfoA
GetCommandLineA
InitializeCriticalSection

user32

FindWindowA
IsWindow
GetWindowThreadProcessId
SwitchToThisWindow
IsCharAlphaNumericA
IsCharAlphaA
RegisterDeviceNotificationA
UpdateWindow
DispatchMessageA
ShowWindow
DefWindowProcA
CreateWindowExA
TranslateMessage
PostQuitMessage
RegisterClassExA
GetMessageA
DestroyWindow
BlockInput
GetWindowTextA
GetForegroundWindow
SendMessageA
FindWindowExA
keybd_event
RealGetWindowClassA
SetFocus
SetForegroundWindow
VkKeyScanW
SendInput
MapVirtualKeyA
VkKeyScanA
GetMenuItemID
PostMessageA
IsWindowVisible

advapi32

LookupPrivilegeValueA
IsTextUnicode
RegCloseKey
RegCreateKeyExA
RegSetValueExA
AdjustTokenPrivileges
RegQueryValueExA
OpenProcessToken
FreeSid
AllocateAndInitializeSid
GetUserNameA
RegOpenKeyExA

shell32

ShellExecuteA
SHChangeNotify
ShellExecuteExA

ole32

CoInitialize
CoUninitialize
CoCreateInstance

oleaut32

SysAllocString
VariantClear
VariantInit

ws2_32

recv
select
send
gethostbyname
closesocket
socket
WSACleanup
WSAGetLastError
inet_addr
WSAStartup
connect
htonl
ntohl
inet_ntoa
gethostname
ioctlsocket
htons

ntdll

NtQuerySystemInformation
ZwSystemDebugControl

shlwapi

SHDeleteKeyA

mpr

WNetCancelConnectionA
WNetUseConnectionA
WNetCancelConnection2A
WNetGetLastErrorA

rpcrt4

RpcBindingFromStringBindingA
RpcStringFreeA
RpcMgmtIsServerListening
RpcMgmtSetComTimeout
NdrClientCall2
RpcMgmtInqStats
RpcBindingFree
RpcStringBindingComposeA
RpcMgmtStatsVectorFree

comctl32

ord17

Sections

.text
Size: 364KB - Virtual size: 364KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

ufpp.dhv
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gkan0ip
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

7yi2bbkf
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

092ca20b4e2feda3e25dbe39504603ca

Headers

DLL Characteristics

File Characteristics

Imports

wininet

kernel32

user32

advapi32

shell32

ole32

oleaut32

ws2_32

ntdll

shlwapi

mpr

rpcrt4

comctl32

Sections

.text Size: 364KB - Virtual size: 364KB

.rsrc Size: 8KB - Virtual size: 8KB

ufpp.dhv Size: 52KB - Virtual size: 52KB

.gkan0ip Size: 72KB - Virtual size: 72KB

7yi2bbkf Size: 20KB - Virtual size: 20KB

.text
Size: 364KB - Virtual size: 364KB

.rsrc
Size: 8KB - Virtual size: 8KB

ufpp.dhv
Size: 52KB - Virtual size: 52KB

.gkan0ip
Size: 72KB - Virtual size: 72KB

7yi2bbkf
Size: 20KB - Virtual size: 20KB