jaffacakes118_DailyNotes Jul 2010 ElegantThemes Premium WordPress[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_DailyNotes Jul 2010 ElegantThemes Premium WordPress.exe
Size 2.5MB
Sample260910-d5ltcawcrf
SHA256 0bf4dd27e0916967199282153d1e6a1c264b6aae2d10ea3c226ec6fd5f89b709
MD5 d537fd4b07871f0cccce1b854195c0f3
SHA1 2ac61d29a30a3e5bd1312eedc8a18380bdb65c25
SHA512 055791e7e59d91792b74cb68409e903be03cde421bb7011d3498ecb661b92f1de779e886a9577f9a24a64adc323b05510c8ac4584a44388867556c542f4ba061
SSDEEP 3072:yfLdR0Eaglx5mdVstpPrTUZDhcKyLeFn1O:gLdR0Eagv53rjA5ph11O
TLSH
T1EBC58D2232C1C072E26315348EA5D2B18B7AFC714E719DEB7BD507BA4F692C2DA24357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_DailyNotes Jul 2010 ElegantThemes Premium WordPress.exe

File Explorer

jaffacakes118_DailyNotes Jul 2010 ElegantThemes Premium WordPress.exe

.exe 2.5MB

jaffacakes118_DailyNotes Jul 2010 ElegantThemes Premium WordPress.exe

IMPHASH c28d40d196cd794d31a155616a0fc23d
SHA256 0bf4dd27e0916967199282153d1e6a1c264b6aae2d10ea3c226ec6fd5f89b709
MD5 d537fd4b07871f0cccce1b854195c0f3
SHA1 2ac61d29a30a3e5bd1312eedc8a18380bdb65c25
SHA512 055791e7e59d91792b74cb68409e903be03cde421bb7011d3498ecb661b92f1de779e886a9577f9a24a64adc323b05510c8ac4584a44388867556c542f4ba061
SSDEEP 3072:yfLdR0Eaglx5mdVstpPrTUZDhcKyLeFn1O:gLdR0Eagv53rjA5ph11O
TLSH
T1EBC58D2232C1C072E26315348EA5D2B18B7AFC714E719DEB7BD507BA4F692C2DA24357
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

30781

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Dokumente und Einstellungen\Admin\eigene dateien\visual studio 2010\Projects\ICWorm\Release\ICWorm.pdb

kernel32

WritePrivateProfileStringA GetModuleFileNameA CreateToolhelp32Snapshot GetVersionExA CloseHandle LoadLibraryA CreateThread SetStdHandle WriteConsoleW SetEnvironmentVariableA GetPrivateProfileStringA CopyFileA GetProcAddress GetLogicalDriveStringsA GetEnvironmentVariableA TerminateProcess CreateProcessA GetExitCodeProcess Sleep OpenProcess GetDriveTypeA DeleteFileA WaitForSingleObject CompareStringW IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID HeapReAlloc GetStringTypeW InterlockedIncrement InterlockedDecrement EncodePointer DecodePointer InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetModuleHandleW ExitProcess GetCommandLineA HeapSetInformation RaiseException RtlUnwind GetLastError HeapFree WideCharToMultiByte LCMapStringW MultiByteToWideChar GetCPInfo HeapAlloc GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent GetFileAttributesA HeapSize TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError GetCurrentThreadId InitializeCriticalSectionAndSpinCount LoadLibraryW GetLocaleInfoW WriteFile GetStdHandle GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType GetStartupInfoW HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetConsoleCP GetConsoleMode FlushFileBuffers ReadFile SetFilePointer GetACP GetOEMCP IsValidCodePage CreateFileW

user32

FindWindowA ShowWindow

advapi32

RegCloseKey CryptDestroyHash CryptCreateHash RegDeleteValueA RegOpenKeyExA CryptAcquireContextA RegCreateKeyExA CryptReleaseContext RegQueryValueExA RegSetValueExA CryptGetHashParam CryptHashData

wininet

InternetReadFile InternetOpenUrlA InternetOpenA InternetCloseHandle

urlmon

URLDownloadToFileA