metasploit | jaffacakes118_HEUR[.]Trojan[.]Win32[.]Generic[.]3d7203e8321437f01e148978817e896b

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.3d7203e8321437f01e148978817e896b
Size 31KB
Sample261014-cgppnatz2n
SHA256 cf1fcf4973120077b11853d1040ee24048b5bdd600dd2043875d57784feea348
MD5 3d7203e8321437f01e148978817e896b
SHA1 5d78d1fde93f75a65f3d35c7ad0766eb33a3529b
SHA512 125dd6c1a503b45526d4694bd8c5c2adedab289891502bd50752c56d489d4ae54825747e84277e7c70600f0d96ec86ba7109564711476452dba5d93aa92126f0
SSDEEP 768:kHDQAYTsrpG1mK2C2C2AumR6BfxSFEhPSwGtPP:kHDQHTSpG1mKZZR67
TLSH
T150E27BD6ABA584A1F7A14F3C2A647637957EAD742C75C0CACBC00CC659B59C2EA3D303
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

trojan backdoor metasploit

Malware Config

Extracted

Family

metasploit

Version

encoder/fnstenv_mov

Signatures

Family: MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_HEUR.Trojan.Win32.Generic.3d7203e8321437f01e148978817e896b

File Explorer

jaffacakes118_HEUR.Trojan.Win32.Generic.3d7203e8321437f01e148978817e896b

.exe 31KB

jaffacakes118_HEUR.Trojan.Win32.Generic.3d7203e8321437f01e148978817e896b

IMPHASH bf3b397a7296f510e58affb20fa81d63
SHA256 cf1fcf4973120077b11853d1040ee24048b5bdd600dd2043875d57784feea348
MD5 3d7203e8321437f01e148978817e896b
SHA1 5d78d1fde93f75a65f3d35c7ad0766eb33a3529b
SHA512 125dd6c1a503b45526d4694bd8c5c2adedab289891502bd50752c56d489d4ae54825747e84277e7c70600f0d96ec86ba7109564711476452dba5d93aa92126f0
SSDEEP 768:kHDQAYTsrpG1mK2C2C2AumR6BfxSFEhPSwGtPP:kHDQHTSpG1mKZZR67
TLSH
T150E27BD6ABA584A1F7A14F3C2A647637957EAD742C75C0CACBC00CC659B59C2EA3D303
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11268

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ntdll

RtlUnwind memcpy NtQueryVirtualMemory _chkstk memset LdrAddRefDll RtlTimeToSecondsSince1970 ZwCreateEvent RtlInitUnicodeString strchr sscanf RtlImageNtHeader _snwprintf atoi strncpy _snprintf RtlRandom

ws2_32

recv closesocket connect WSAStartup htons sendto recvfrom setsockopt WSAIoctl bind socket send inet_addr

shlwapi

StrStrIA SHEnumKeyExA PathFileExistsW SHGetValueW PathFindFileNameW PathRemoveExtensionW SHDeleteValueA PathFileExistsA SHSetValueW SHSetValueA PathAppendA PathAddExtensionA PathRemoveExtensionA SHGetValueA StrStrIW PathFindFileNameA

wininet

InternetQueryOptionA InternetCrackUrlA InternetConnectA HttpOpenRequestA HttpSendRequestA InternetSetOptionA InternetReadFile InternetCloseHandle InternetOpenA

iphlpapi

CreateIpNetEntry GetIpAddrTable

shell32

ShellExecuteExW

rpcrt4

UuidCreateSequential UuidFromStringA UuidToStringA

mpr

WNetEnumResourceA WNetCloseEnum WNetAddConnection2A WNetCancelConnection2A WNetOpenEnumA

winspool.drv

AddPrintProvidorW

psapi

GetMappedFileNameW GetMappedFileNameA

imagehlp

MapFileAndCheckSumA CheckSumMappedFile

wtsapi32

WTSQueryUserToken

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

ole32

CoInitializeEx CoCreateInstance CoInitialize CoUninitialize

kernel32

Sleep CreateThread SleepEx GetCurrentThreadId OpenThread QueueUserAPC GetLastError ReadFile TransactNamedPipe UnmapViewOfFile GetFileSize MapViewOfFile CreateFileMappingA GetModuleFileNameA GetModuleHandleW VirtualFree VirtualAlloc WritePrivateProfileStringA CloseHandle SetFileAttributesA SetFileAttributesW WriteFile CreateFileA GetTickCount QueueUserWorkItem GetTempFileNameA DeleteFileA GetPrivateProfileStringA CreateFileW DeviceIoControl ExitProcess InitializeCriticalSection lstrcmpiA LeaveCriticalSection MoveFileExA EnterCriticalSection WinExec GetPrivateProfileIntA LockFile WTSGetActiveConsoleSessionId GetModuleHandleA GetProcAddress MoveFileExW DeleteFileW GetTempPathW GetTempFileNameW GetCurrentProcessId GetTempPathA OutputDebugStringW CopyFileW GetSystemTimeAsFileTime

user32

RegisterDeviceNotificationA DestroyWindow IsCharAlphaA CharUpperBuffA CharLowerBuffA DefWindowProcA CreateWindowExA SetWindowLongA UnregisterDeviceNotification GetMessageA TranslateMessage DispatchMessageA

advapi32

CreateProcessAsUserA GetTokenInformation CloseServiceHandle QueryServiceStatusEx StartServiceA OpenSCManagerA OpenServiceA RegCloseKey RegSetValueExA RegQueryValueExA RegOpenKeyA CreateServiceW