jaffacakes118__962d346c8a9d6eedda047ed1e1c9aef3

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118__962d346c8a9d6eedda047ed1e1c9aef3
Size 62KB
Sample260919-qs46davy5q
SHA256 0f145e5e05cc07a4ef45c4031479028e270ea94d4b194468912f363e873feb03
MD5 962d346c8a9d6eedda047ed1e1c9aef3
SHA1 4392efdae4db4ba40c9047b80fdf26271b83f16a
SHA512 856aa7f2c4f5cb7e950748acc4368221b0bac764e937c249c8760f741b98edf03e1baa3643b8cb98e57d40890739ee1e0683abf2d85eaba82b9a563f1947e45a
SSDEEP 1536:zI4WkaAb5anFjMMW7MMs0+2vIiMrgn/7XNkouQ:zIZwlanlMMYMMsVQIE/DN
TLSH
T1E553CF12F7D48229C0D6083559B7671918A8BD511F2083CF71AE6BEF2FB46D869322DB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118__962d346c8a9d6eedda047ed1e1c9aef3

File Explorer

jaffacakes118__962d346c8a9d6eedda047ed1e1c9aef3

.exe 62KB

jaffacakes118__962d346c8a9d6eedda047ed1e1c9aef3

IMPHASH 5de0cabe853d959c3319b51c8ec562e6
SHA256 0f145e5e05cc07a4ef45c4031479028e270ea94d4b194468912f363e873feb03
MD5 962d346c8a9d6eedda047ed1e1c9aef3
SHA1 4392efdae4db4ba40c9047b80fdf26271b83f16a
SHA512 856aa7f2c4f5cb7e950748acc4368221b0bac764e937c249c8760f741b98edf03e1baa3643b8cb98e57d40890739ee1e0683abf2d85eaba82b9a563f1947e45a
SSDEEP 1536:zI4WkaAb5anFjMMW7MMs0+2vIiMrgn/7XNkouQ:zIZwlanlMMYMMsVQIE/DN
TLSH
T1E553CF12F7D48229C0D6083559B7671918A8BD511F2083CF71AE6BEF2FB46D869322DB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

73982

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

UI0Detect.pdb

advapi32

CheckTokenMembership SetServiceStatus ReportEventW RegisterEventSourceW DeregisterEventSource RegisterServiceCtrlHandlerW StartServiceCtrlDispatcherW RevertToSelf CreateProcessAsUserW ImpersonateLoggedOnUser

kernel32

CloseHandle UnmapViewOfFile DuplicateHandle GetCurrentProcess MapViewOfFile CreateFileMappingW GetProcessHeap HeapFree lstrcmpW K32GetModuleBaseNameW K32GetModuleInformation GetLastError K32EnumProcessModules CompareStringW lstrlenW CompareFileTime GetSystemTimeAsFileTime K32GetModuleFileNameExW OpenProcess GetCurrentProcessId SetLastError GetTickCount HeapSetInformation GetCurrentThreadId LocalFree FormatMessageW GetModuleHandleW CreateEventW DelayLoadFailureHook GetProcAddress FreeLibrary InterlockedCompareExchange LoadLibraryExA Sleep HeapAlloc TerminateProcess QueryPerformanceCounter GetModuleHandleA SetUnhandledExceptionFilter GetStartupInfoA InterlockedExchange UnhandledExceptionFilter

gdi32

CreateSolidBrush

user32

EnumWindows RegisterShellHookWindow SetWindowLongW RegisterWindowMessageW PostQuitMessage IsWindow DestroyWindow DefWindowProcW SetTimer GetLastInputInfo MoveWindow GetSystemMetrics KillTimer SetShellWindow SystemParametersInfoW ShowWindow GetWindowTextW RegisterClassW GetWindow UnregisterClassW DispatchMessageW GetMessageW GetUserObjectInformationW GetThreadDesktop GetProcessWindowStation LoadStringW FlashWindowEx DestroyIcon LoadIconW GetWindowRect FindWindowW SendMessageW GetWindowLongW GetClassLongW PostMessageW GetWindowThreadProcessId GetWindowInfo GetClassNameW LoadCursorW GetWindowTextLengthW SetTaskmanWindow CreateWindowExW

msvcrt

memset _vsnwprintf wcsrchr _atoi64 __getmainargs _exit _XcptFilter _ismbblead exit ?terminate@@YAXXZ _acmdln _controlfp _except_handler4_common __set_app_type __p__fmode __p__commode _initterm _cexit _amsg_exit __setusermatherr

ntdll

WinSqmIsOptedIn WinSqmSetDWORD WinSqmEndSession WinSqmStartSession WinSqmSetString WinSqmAddToAverageDWORD WinSqmAddToStream WinSqmIncrementDWORD RtlAllocateAndInitializeSid RtlFreeSid

wtsapi32

WTSUnRegisterSessionNotification WTSRegisterSessionNotification WTSDisconnectSession WTSQueryUserToken

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

winsta

WinStationGetSessionIds WinStationRevertFromServicesSession WinStationSwitchToServicesSession

shell32

SHGetFolderPathW

shlwapi

ord354

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118__962d346c8a9d6eedda047ed1e1c9aef3

advapi32

kernel32

gdi32

user32

msvcrt

ntdll

wtsapi32

version

winsta

shell32

shlwapi

generic