jaffacakes118__2e86b7bcc70642102ca424141000c518

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118__2e86b7bcc70642102ca424141000c518
Size 321KB
Sample260919-22e4dsvs8p
SHA256 353693579f8b53ec8795401c3e1763e67c5c68aa785a68f3a998230c00dd9d7c
MD5 2e86b7bcc70642102ca424141000c518
SHA1 981a5a84a7d05ad5ca46ce27f62c3b3c9c770d3f
SHA512 395ad3cd720bada101781b4c349a9ae07bff051930e80963a2f67fca8e49e9335b276b47e79dfe9fe17c86b85fb0ab15ff13073d68af189b53fd3e2a3d1aa3f6
SSDEEP 6144:fkbHTkIubE30ZhZxbpvqwowowowowowowowowowowowowowowowowowowowowow+:fkfkIuhZj5pucd1xHD+9
TLSH
T183648E2E3EFE9073D57726301DB1956A66F1B923AF34945AF3452B8C5A30F90936830A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118__2e86b7bcc70642102ca424141000c518

File Explorer

jaffacakes118__2e86b7bcc70642102ca424141000c518

.exe 321KB

jaffacakes118__2e86b7bcc70642102ca424141000c518

IMPHASH 4a6aa184f74d3c1d08c3452152cc0d08
SHA256 353693579f8b53ec8795401c3e1763e67c5c68aa785a68f3a998230c00dd9d7c
MD5 2e86b7bcc70642102ca424141000c518
SHA1 981a5a84a7d05ad5ca46ce27f62c3b3c9c770d3f
SHA512 395ad3cd720bada101781b4c349a9ae07bff051930e80963a2f67fca8e49e9335b276b47e79dfe9fe17c86b85fb0ab15ff13073d68af189b53fd3e2a3d1aa3f6
SSDEEP 6144:fkbHTkIubE30ZhZxbpvqwowowowowowowowowowowowowowowowowowowowowow+:fkfkIuhZj5pucd1xHD+9
TLSH
T183648E2E3EFE9073D57726301DB1956A66F1B923AF34945AF3452B8C5A30F90936830A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

68464

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\pulse\recipes\283718449\base\branches\ci_release_branch\googleclient\ci\build\ship\obj\service\GoogleUpdaterService_not_signed_exe.pdb

kernel32

GetStdHandle GetModuleFileNameA GetCPInfo GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA SetHandleCount GetFileType GetStartupInfoA GetConsoleCP GetConsoleMode LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle CreateFileA SystemTimeToTzSpecificLocalTime lstrcmpW DuplicateHandle GetProcAddress GetCurrentThread MultiByteToWideChar GetTempPathW WaitForSingleObject SetLastError OpenProcess InitializeCriticalSection lstrcpynW CloseHandle lstrlenW CreateThread lstrcmpiW FindResourceExW CreateEventW LoadResource FindResourceW LoadLibraryExW LockResource InterlockedIncrement SizeofResource SetEvent GetLastError InterlockedDecrement GetCurrentThreadId GetModuleHandleW DeleteCriticalSection VirtualFree HeapCreate RtlUnwind GetModuleHandleA VirtualAlloc LoadLibraryA GetStartupInfoW SetUnhandledExceptionFilter RaiseException GetModuleFileNameW FreeLibrary GetCommandLineW GetCurrentProcessId Sleep GetTempFileNameW UnhandledExceptionFilter GetLocaleInfoA GetACP InterlockedExchange GetProcessHeap HeapSize HeapReAlloc HeapFree HeapAlloc HeapDestroy GetVersionExA QueryPerformanceFrequency QueryPerformanceCounter ResetEvent CreateFileW GetFileAttributesExW FindFirstFileW FindNextFileW GetFileAttributesW SetFileAttributesW DeleteFileW CopyFileW MoveFileExW GetTickCount FlushFileBuffers SetFilePointer ReadFile WriteFile GetFileSize GetSystemTimeAsFileTime FindClose FileTimeToSystemTime CreateProcessW GetCurrentProcess ReleaseMutex EnterCriticalSection LeaveCriticalSection InterlockedCompareExchange CreateMutexW RemoveDirectoryW GetExitCodeProcess FileTimeToLocalFileTime GetVersionExW WideCharToMultiByte GetThreadLocale GetDateFormatW GetTimeFormatW IsDebuggerPresent ExitProcess TerminateProcess

user32

UnregisterClassA CharLowerW CharNextW LoadStringW DispatchMessageW TranslateMessage GetMessageW PostThreadMessageW KillTimer wvsprintfW SetTimer

ole32

CoRevertToSelf CoCreateGuid StringFromGUID2 CoCreateInstance CoTaskMemRealloc CoUninitialize CoRegisterClassObject CoInitializeSecurity CoInitialize CoRevokeClassObject CoTaskMemAlloc CoTaskMemFree CoImpersonateClient

oleaut32

SysFreeString RegisterTypeLi SysStringLen VarUI4FromStr SysAllocString LoadTypeLi UnRegisterTypeLi

advapi32

GetSecurityDescriptorControl GetSecurityDescriptorLength GetSidSubAuthority RegCloseKey RegDeleteKeyW MakeSelfRelativeSD InitializeSid FreeSid AllocateAndInitializeSid CheckTokenMembership OpenThreadToken ControlService SetSecurityDescriptorDacl StartServiceW GetSecurityDescriptorDacl QueryServiceStatus SetSecurityDescriptorGroup RegSetValueExW GetSecurityDescriptorGroup ChangeServiceConfigW RegCreateKeyExW SetSecurityDescriptorOwner OpenServiceW GetSecurityDescriptorOwner DeleteService OpenSCManagerW ChangeServiceConfig2W CreateServiceW IsValidSid RegQueryInfoKeyW SetServiceStatus GetLengthSid DeregisterEventSource ReportEventW RegisterEventSourceW RegisterServiceCtrlHandlerW RegEnumKeyExW GetAclInformation AddAce StartServiceCtrlDispatcherW InitializeAcl InitializeSecurityDescriptor MakeAbsoluteSD SetSecurityDescriptorControl RegOpenKeyExW CopySid CloseServiceHandle GetSidLengthRequired GetSecurityDescriptorSacl RegQueryValueExW RegDeleteValueW

shlwapi

StrRetToStrW SHQueryValueExW PathStripPathW

crypt32

CryptQueryObject CertEnumCertificatesInStore CertCloseStore CertDuplicateCertificateContext CertFreeCertificateContext CertNameToStrW

shell32

SHGetDesktopFolder SHCreateDirectoryExW SHGetFolderLocation SHFileOperationW

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

wintrust

WinVerifyTrust

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118__2e86b7bcc70642102ca424141000c518

kernel32

user32

ole32

oleaut32

advapi32

shlwapi

crypt32

shell32

version

wintrust

generic