jaffacakes118_(FTD) Scientific[.]Toolworks[.]Understand[.]v2[.]6[.]549[.]Incl[.]Keygen-Lz0 - yEnc __ypost[.]exe_ (1_2)

General

Target
jaffacakes118_(FTD) Scientific.Toolworks.Understand.v2.6.549.Incl.Keygen-Lz0 - yEnc __ypost.exe_ (1_2)
Size 240KB
Sample260910-cv2ldatfqe
SHA256 9eaaed6bd79bb4d3c837a1f3771baa4d5d745c7750d3db93c8de9d2d1649618f
MD5 aaa75a822055477ea4d03d0ac965853f
SHA1 573d143c6a017d6b187100a37b2923ba8aae9a6a
SHA512 f480a8e57a325ac45307600835d1dd7d65b854bbe1fd9facfef9159fa771cb2509fac1ef4a6894a7b039d3efe1fae4ddd86ab75922a3bddd6cd91318053fa414
SSDEEP 3072:7KBzerVJ9jXp3ZYVvNRg92mICS0jE26oZR+XOAsx6FhMtrVvOpWVbEx7joCc:7tnXpJOlRtmIVcZeTusMtrdOpWix7dc
TLSH
T167349E22F6E2C0B2DB02007A4CEA57B9F77E94B55E02D5C353A8DE1DDE229D3D236119
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_(FTD) Scientific.Toolworks.Understand.v2.6.549.Incl.Keygen-Lz0 - yEnc __ypost.exe_ (1_2)

File Explorer

jaffacakes118_(FTD) Scientific.Toolworks.Understand.v2.6.549.Incl.Keygen-Lz0 - yEnc __ypost.exe_ (1_2)

.exe 240KB

jaffacakes118_(FTD) Scientific.Toolworks.Understand.v2.6.549.Incl.Keygen-Lz0 - yEnc __ypost.exe_ (1_2)

IMPHASH 07ff7c0ee0aee5f81eeb91a5e57124fc
SHA256 9eaaed6bd79bb4d3c837a1f3771baa4d5d745c7750d3db93c8de9d2d1649618f
MD5 aaa75a822055477ea4d03d0ac965853f
SHA1 573d143c6a017d6b187100a37b2923ba8aae9a6a
SHA512 f480a8e57a325ac45307600835d1dd7d65b854bbe1fd9facfef9159fa771cb2509fac1ef4a6894a7b039d3efe1fae4ddd86ab75922a3bddd6cd91318053fa414
SSDEEP 3072:7KBzerVJ9jXp3ZYVvNRg92mICS0jE26oZR+XOAsx6FhMtrVvOpWVbEx7joCc:7tnXpJOlRtmIVcZeTusMtrdOpWix7dc
TLSH
T167349E22F6E2C0B2DB02007A4CEA57B9F77E94B55E02D5C353A8DE1DDE229D3D236119
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

135761

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CloseHandle GetTickCount FindClose FindNextFileA GetLastError FindFirstFileA ReadFile FlushFileBuffers GetCurrentDirectoryA GetFullPathNameA DeleteFileA GetDriveTypeA FileTimeToLocalFileTime FileTimeToSystemTime GetLocaleInfoW SetEndOfFile LoadLibraryA SetEnvironmentVariableA GetOEMCP GetACP CreateFileA SetStdHandle IsBadCodePtr WideCharToMultiByte MultiByteToWideChar RtlUnwind RaiseException ExitProcess TerminateProcess GetCurrentProcess HeapFree HeapAlloc GetCommandLineA GetVersion HeapReAlloc LCMapStringA LCMapStringW GetCPInfo CompareStringA CompareStringW HeapSize SetUnhandledExceptionFilter GetProcAddress GetModuleHandleA Sleep WriteFile SetFilePointer IsBadReadPtr GetEnvironmentStringsW GetModuleFileNameA GetEnvironmentVariableA GetVersionExA HeapDestroy HeapCreate VirtualFree VirtualAlloc IsBadWritePtr UnhandledExceptionFilter FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings IsValidCodePage SetHandleCount GetStdHandle GetFileType GetStartupInfoA IsValidLocale GetLocaleInfoA EnumSystemLocalesA GetUserDefaultLCID GetTimeZoneInformation GetStringTypeA GetStringTypeW

ws2_32

WSACleanup WSAStartup WSAGetLastError socket connect setsockopt send select recv htonl inet_addr gethostbyname htons

Sharing