jaffacakes118_Backdoor[.]Win32[.]Gbot[.]ftl[.]1feefb70f9586baf9a9f2f4ef953d5e3

General

Target
jaffacakes118_Backdoor.Win32.Gbot.ftl.1feefb70f9586baf9a9f2f4ef953d5e3
Size 139KB
Sample261009-tkvhra1s8l
SHA256 54e876ecdd1860df80b8706b3ed408a39ebe6fd678e716052ae0d014ff8995e7
MD5 1feefb70f9586baf9a9f2f4ef953d5e3
SHA1 8c4b42178558d3504f10f06f4d75590036234c48
SHA512 8e5d397fedbc32ae62c4b3e51f4f6b240e8dfec431e31b7e0a8270341666e61b79a069257ca7685b089120d401edce1dbb472d7db5e26122deffc90691e25420
SSDEEP 3072:s7GVJRVZGNfervjkF/zkoujp4n7qwfDnU8Or:s6zR6ZerwFLDut4ntUz
TLSH
T195D30221D3EA7B8AE6BB4E3208F67BD54939B9101D750F1B1451B19C0DBE301EBA8723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Backdoor.Win32.Gbot.ftl.1feefb70f9586baf9a9f2f4ef953d5e3

File Explorer

jaffacakes118_Backdoor.Win32.Gbot.ftl.1feefb70f9586baf9a9f2f4ef953d5e3

.exe 139KB

jaffacakes118_Backdoor.Win32.Gbot.ftl.1feefb70f9586baf9a9f2f4ef953d5e3

IMPHASH 7b828159d9266f6f3c671bb58fbc09e9
SHA256 54e876ecdd1860df80b8706b3ed408a39ebe6fd678e716052ae0d014ff8995e7
MD5 1feefb70f9586baf9a9f2f4ef953d5e3
SHA1 8c4b42178558d3504f10f06f4d75590036234c48
SHA512 8e5d397fedbc32ae62c4b3e51f4f6b240e8dfec431e31b7e0a8270341666e61b79a069257ca7685b089120d401edce1dbb472d7db5e26122deffc90691e25420
SSDEEP 3072:s7GVJRVZGNfervjkF/zkoujp4n7qwfDnU8Or:s6zR6ZerwFLDut4ntUz
TLSH
T195D30221D3EA7B8AE6BB4E3208F67BD54939B9101D750F1B1451B19C0DBE301EBA8723
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

4861

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

FindNextFileW VirtualAlloc RtlUnwind DosPathToSessionPathA VirtualFree ExitThread GetModuleHandleA DeleteFileA LoadLibraryW GetLastError TlsGetValue CreateDirectoryW GlobalFree CreateProcessA GetProcAddress VirtualProtect GetTimeFormatW HeapFree GetNumberFormatW OutputDebugStringA GetCurrentDirectoryA GetACP lstrcmpW SetErrorMode CreateDirectoryExW

msvcrt

wcsrchr wcstok swscanf memcpy __setusermatherr wcsncpy _wtoi strncpy wcscmp wcstol printf _wcsnicmp _wcsicmp towupper atoi iswprint _XcptFilter toupper __CxxFrameHandler _wcmdln

user32

GetMenuItemCount DispatchMessageW ScreenToClient ReleaseCapture ClientToScreen CopyRect wsprintfW GetCursorPos LoadCursorA UnregisterClassW LoadImageW MapWindowPoints DialogBoxParamA GetParent LoadCursorW GetProcessWindowStation DestroyWindow RegisterClassA SetScrollPos CheckDlgButton IsWindow SendMessageA ReleaseDC LoadMenuW SetCapture SendMessageW BeginPaint

gdi32

CreateBitmap TranslateCharsetInfo SetBkMode CreateCompatibleDC SetTextColor Rectangle PatBlt RestoreDC StretchBlt CreateFontIndirectW

opengl32

glColor4d glTexCoord2d glColor4i wglShareLists glFogfv GlmfBeginGlsBlock glStencilMask glColor3ui glTexCoord2dv glColor4f

Name

.text

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.crt

Size

512B

Virtual Size

72B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.edata

Size

512B

Virtual Size

115B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

57KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

64KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

254B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_Backdoor.Win32.Gbot.ftl.1feefb70f9586baf9a9f2f4ef953d5e3

kernel32

msvcrt

user32

gdi32

opengl32

generic