metasploit | JaffaCakes118_98bdfe850392488fdf9c095dec277d7a

Sharing

Copy URL

Twitter E-mail

General

Target

JaffaCakes118_98bdfe850392488fdf9c095dec277d7a
Size

92KB
MD5

98bdfe850392488fdf9c095dec277d7a
SHA1

a5955cee800b82cb4f4960022a458aa6315e7bdd
SHA256

8ccd60bef0c3fec91c51f3ac7c473d342b6dc6145f3267f0f780afeebf726380
SHA512

e71dc8483fac2b70db688ecb31932d4ec80cb9d559151910136ebd60c6a2beea5a7daaa25105957851c1834d636741d6ee950a4226959539db4c0830d6b93cc7
SSDEEP

1536:zShWgnBHBqL2uPj+v/9qYziQnk2E4C11O/FmHTD34CYYhh9QIZ5O8hvEnmnt:+WgBHBqS9qYziQnXEd11lheIZ5lwm

Score

10^/10

metasploit

Malware Config

Extracted

Family

metasploit

Version

encoder/fnstenv_mov

Signatures

Metasploit family
metasploit

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_98bdfe850392488fdf9c095dec277d7a

Files

JaffaCakes118_98bdfe850392488fdf9c095dec277d7a
.dll windows:4 windows x86 arch:x86

e8fc725ab682a6620a1c1627dd31a25b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

WSACleanup
ntohs
inet_ntoa
setsockopt
ntohl
inet_addr
getsockname
gethostbyaddr
gethostbyname
WSAStartup
sendto
bind
listen
ioctlsocket
accept
WSAGetLastError
socket
htons
connect
closesocket
htonl
send
select
__WSAFDIsSet
recv

shell32

ShellExecuteA

advapi32

RegCloseKey
RegDeleteValueA
RegCreateKeyExA
RegSetValueExA
GetUserNameA

wininet

InternetConnectA
InternetCrackUrlA
InternetWriteFile
InternetCloseHandle
InternetOpenA
InternetOpenUrlA
InternetReadFile
FtpOpenFileA

user32

MapVirtualKeyExA
GetKeyNameTextA
GetKeyboardLayout
GetAsyncKeyState

msvcp60

??1_Winit@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z
??0Init@ios_base@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ

msvcrt

_stricmp
__CxxFrameHandler
strlen
memcpy
memset
malloc
free
floor
_ftol
ceil
_itoa
_endthreadex
_snprintf
strncat
strtok
strncpy
strcmp
strstr
srand
fclose
fwrite
fopen
rand
sscanf
_beginthreadex
exit
strtoul
atoi
strcat
_vsnprintf
_splitpath
atol
__dllonexit
_onexit
_initterm
_adjust_fdiv

kernel32

CreateToolhelp32Snapshot
Process32First
Process32Next
DeleteFileA
GetLocaleInfoA
GetTempFileNameA
GetTempPathA
WriteFile
SetFileAttributesA
CopyFileA
GetSystemDirectoryA
TerminateProcess
GetVersionExA
GetComputerNameA
SetErrorMode
GetTickCount
CreateMutexA
WaitForSingleObject
GetModuleFileNameA
GetDateFormatA
GetTimeFormatA
ExitThread
OpenProcess
CloseHandle
TerminateThread
CreateThread
GlobalMemoryStatus
SetFilePointer
ReadFile
FindFirstFileA
FindNextFileA
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
GetFileAttributesA
CreateFileA
GetFileSize
Sleep

Exports

Exports

start

Sections

.text
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 130KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

e8fc725ab682a6620a1c1627dd31a25b

Headers

File Characteristics

Imports

ws2_32

shell32

advapi32

wininet

user32

msvcp60

msvcrt

kernel32

Exports

Exports

Sections

.text Size: 48KB - Virtual size: 47KB

.rdata Size: 8KB - Virtual size: 6KB

.data Size: 24KB - Virtual size: 130KB

.reloc Size: 8KB - Virtual size: 4KB

.text
Size: 48KB - Virtual size: 47KB

.rdata
Size: 8KB - Virtual size: 6KB

.data
Size: 24KB - Virtual size: 130KB

.reloc
Size: 8KB - Virtual size: 4KB