jaffacakes118_Backdoor[.]Win32[.]Agobot[.]adw[.]728ccc2d75f99a91da6e2955174b83f1

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Backdoor.Win32.Agobot.adw.728ccc2d75f99a91da6e2955174b83f1
Size 532KB
Sample261012-3trynacw8p
SHA256 db41ad36675ffb866cda566fba908235151bbc874994e218bf03b6ddde165675
MD5 728ccc2d75f99a91da6e2955174b83f1
SHA1 372aec6586cab917f6417e5dd55e17380622e941
SHA512 19080608eb4ac64d0c0f9e323e75e09981346f18ee2eb4e25bfc9996e4a99d0f8b4e4204c09d9bc8863f6d0cf22b503a56660da34c43e2fcd89e8b7b707fb148
SSDEEP 12288:Hi8qBbDp3zQ424F+3KbPl5fEKBvJJCDk6cvyK2z:C8IBtmKwMvJUDlJK2z
TLSH
T1D5C45C22B6026069D64D45336AE987F169E23531CF9B2CC3B3409E7B25BF391973264F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Backdoor.Win32.Agobot.adw.728ccc2d75f99a91da6e2955174b83f1

File Explorer

jaffacakes118_Backdoor.Win32.Agobot.adw.728ccc2d75f99a91da6e2955174b83f1

.exe 532KB

jaffacakes118_Backdoor.Win32.Agobot.adw.728ccc2d75f99a91da6e2955174b83f1

IMPHASH 14d2c5d2e6459d9d82561302c26be74c
SHA256 db41ad36675ffb866cda566fba908235151bbc874994e218bf03b6ddde165675
MD5 728ccc2d75f99a91da6e2955174b83f1
SHA1 372aec6586cab917f6417e5dd55e17380622e941
SHA512 19080608eb4ac64d0c0f9e323e75e09981346f18ee2eb4e25bfc9996e4a99d0f8b4e4204c09d9bc8863f6d0cf22b503a56660da34c43e2fcd89e8b7b707fb148
SSDEEP 12288:Hi8qBbDp3zQ424F+3KbPl5fEKBvJJCDk6cvyK2z:C8IBtmKwMvJUDlJK2z
TLSH
T1D5C45C22B6026069D64D45336AE987F169E23531CF9B2CC3B3409E7B25BF391973264F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

437664

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

ws2_32

shutdown __WSAFDIsSet connect ntohl WSAStartup gethostname sendto WSASocketA inet_addr WSAIoctl WSAGetLastError getpeername WSACleanup ioctlsocket setsockopt htonl gethostbyaddr socket htons bind getsockname listen gethostbyname ntohs select closesocket accept send recv inet_ntoa

mpr

WNetCancelConnection2W WNetAddConnection2W

psapi

EnumProcessModules EnumProcesses GetModuleBaseNameA

kernel32

CloseHandle GetFileSize CreateFileA FreeLibrary GlobalFree WriteFile GlobalAlloc InterlockedExchange CreateMutexA GetWindowsDirectoryA DeleteFileA GetSystemDirectoryA CreateProcessA ExpandEnvironmentStringsA ExitProcess GetComputerNameA GetVersionExA GlobalMemoryStatus PeekNamedPipe TerminateProcess WaitNamedPipeA CreateNamedPipeA GetModuleFileNameA CopyFileA GetLastError WaitForSingleObject RemoveDirectoryA CreateDirectoryA MoveFileA MultiByteToWideChar GetTempPathA CreateEventA HeapFree SetFilePointer CreateRemoteThread GetProcessHeap WriteProcessMemory VirtualAllocEx OpenProcess GetCurrentProcess GetCurrentThread FindClose FindNextFileA SystemTimeToTzSpecificLocalTime FileTimeToSystemTime FindFirstFileA TransactNamedPipe GetDriveTypeA GetLogicalDrives GetDiskFreeSpaceExA QueryPerformanceFrequency QueryPerformanceCounter GetStartupInfoA RaiseException DebugBreak OutputDebugStringA FreeConsole AllocConsole ReadFile Sleep GetModuleHandleA LoadLibraryA GetProcAddress GetTickCount HeapAlloc GetStdHandle SetConsoleTextAttribute CreateThread TerminateThread VirtualFreeEx

user32

ExitWindowsEx ReleaseDC wsprintfA

gdi32

GetDeviceCaps CreateCompatibleBitmap CreateCompatibleDC SelectObject BitBlt GetDIBits CreateDCA

advapi32

CryptGenRandom CryptAcquireContextA DeleteService EnumServicesStatusA RegQueryValueExA OpenThreadToken OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges StartServiceCtrlDispatcherA RegisterServiceCtrlHandlerA SetServiceStatus ControlService StartServiceA OpenServiceA OpenSCManagerA CreateServiceA CloseServiceHandle ChangeServiceConfig2A RegCreateKeyExA InitializeSecurityDescriptor SetSecurityDescriptorDacl GetUserNameA RegOpenKeyExA RegSetValueExA RegCloseKey RegDeleteValueA

shell32

SHGetDiskFreeSpaceExA ShellExecuteA

msvcp71d

?length@?$char_traits@D@std@@SAIPBD@Z ?move@?$char_traits@D@std@@SAPADPADPBDI@Z ?eq@?$char_traits@D@std@@SA_NABD0@Z ?_Nomemory@std@@YAXXZ

msvcr71d

calloc _callnewh _controlfp __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _amsg_exit _acmdln _ismbblead time _ftol vsprintf _cexit _XcptFilter _exit _c_exit ?terminate@@YAXXZ _except_handler3 _onexit __dllonexit ??1type_info@@UAE@XZ __CxxFrameHandler ??3@YAXPAX@Z _purecall atoi atol ??2@YAPAXIHPBDH@Z strstr memset memcpy strncpy strlen _vsnprintf ??0exception@@QAE@ABV0@@Z _CxxThrowException ??1exception@@UAE@XZ ??0exception@@QAE@XZ memmove system strcpy ??_V@YAXPAX@Z ??_U@YAPAXIHPBDH@Z strcmp memcmp atof strncmp exit fclose fwrite fopen rand fprintf free _malloc_dbg fread ftell fseek srand strtok _snprintf wcscat fputc strncat sscanf ferror feof strcat tolower strerror _errno perror printf _iob malloc isdigit strchr sprintf fflush realloc _CRT_RTC_INIT

dnsapi

DnsQuery_A