jaffacakes118_Backdoor[.]Win32[.]IRCBot[.]gen[.]5287be8d9a7e2b1f1e7cf7185663fda8

General

Target
jaffacakes118_Backdoor.Win32.IRCBot.gen.5287be8d9a7e2b1f1e7cf7185663fda8
Size 132KB
Sample261014-gr18naeg39
SHA256 83f974414335f6d4e37922824e996146f07936829ab4fe32e63276ed2867f15e
MD5 5287be8d9a7e2b1f1e7cf7185663fda8
SHA1 a599945d0fc1cc05ee60f3879b6ac384d148dacb
SHA512 f242145419b76656b0212392658bdcdff1957da91abe1dc0232b6e3134589ec10a3ea17d0387ed3cde56f782c0627b25715bbf0aefa91d47d4d8f68a496974c8
SSDEEP 1536:WSlVlF3ev2uAvxj9bBzeQLz+Ml23AhoHo0CLSz:WgnF382X591ik83AhoI0CLSz
TLSH
T15ED30712B64084B5F34907321506FAF5596A9E3C14E8E54FE73CFD3AA9321836A7728F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Backdoor.Win32.IRCBot.gen.5287be8d9a7e2b1f1e7cf7185663fda8

File Explorer

jaffacakes118_Backdoor.Win32.IRCBot.gen.5287be8d9a7e2b1f1e7cf7185663fda8

.exe 132KB

jaffacakes118_Backdoor.Win32.IRCBot.gen.5287be8d9a7e2b1f1e7cf7185663fda8

IMPHASH 54c3d0c722bc67f534dfe8460edaee20
SHA256 83f974414335f6d4e37922824e996146f07936829ab4fe32e63276ed2867f15e
MD5 5287be8d9a7e2b1f1e7cf7185663fda8
SHA1 a599945d0fc1cc05ee60f3879b6ac384d148dacb
SHA512 f242145419b76656b0212392658bdcdff1957da91abe1dc0232b6e3134589ec10a3ea17d0387ed3cde56f782c0627b25715bbf0aefa91d47d4d8f68a496974c8
SSDEEP 1536:WSlVlF3ev2uAvxj9bBzeQLz+Ml23AhoHo0CLSz:WgnF382X591ik83AhoI0CLSz
TLSH
T15ED30712B64084B5F34907321506FAF5596A9E3C14E8E54FE73CFD3AA9321836A7728F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

35611

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\Documents and Settings\Luca\Documenti\Visual Studio Projects\Snorky.C\Release\Snorky.pdb

kernel32

GetFileType CloseHandle MapViewOfFile CreateFileMappingA CreateFileA DuplicateHandle GetCurrentProcess WriteFile SystemTimeToFileTime GetLocalTime FindClose FindNextFileA FindFirstFileA SetCurrentDirectoryA CreateProcessA CreateDirectoryA GetFileInformationByHandle GetWindowsDirectoryA GetModuleFileNameA Sleep lstrcatA lstrlenA lstrcpyA GetDriveTypeA GetSystemDirectoryA UnmapViewOfFile SetFileAttributesA CopyFileA CreateThread CompareStringW CompareStringA VirtualQuery GetFileSize SetFilePointer ReadFile FileTimeToDosDateTime DeleteFileA FileTimeToSystemTime GetSystemInfo VirtualProtect GetLocaleInfoA LCMapStringW LCMapStringA GetStringTypeW MultiByteToWideChar GetStringTypeA GetCPInfo GetOEMCP GetACP SetEnvironmentVariableA IsBadCodePtr GetLastError RemoveDirectoryA ExitProcess GetProcAddress GetModuleHandleA TerminateProcess RtlUnwind GetStartupInfoA GetCommandLineA GetVersionExA SetHandleCount GetStdHandle WideCharToMultiByte GetTimeZoneInformation HeapFree QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime HeapAlloc UnhandledExceptionFilter FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapDestroy HeapCreate VirtualFree SetStdHandle SetEndOfFile FlushFileBuffers VirtualAlloc HeapReAlloc IsBadWritePtr LoadLibraryA HeapSize SetUnhandledExceptionFilter IsBadReadPtr

user32

ExitWindowsEx MessageBoxA

advapi32

RegSetValueExA RegOpenKeyExA RegDeleteValueA RegCloseKey RegOpenKeyA

ws2_32

gethostbyname inet_addr socket htons closesocket bind listen accept recv send connect htonl WSAStartup

Sharing