jaffacakes118__999d8db8668c6098728b3faa4944fde7

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118__999d8db8668c6098728b3faa4944fde7
Size 46KB
Sample260919-r2laassamd
SHA256 0c5f3e1d76e7dd1f653043836a225e8803fcac6723433e6269e6b872c8a84a86
MD5 999d8db8668c6098728b3faa4944fde7
SHA1 f56d7a1371a1c7b2d61cb83a8b52568e1cc71834
SHA512 3e2e498b72de33cf98ef6e4d37e8fb2a1b8d61b74d7df5ef3015af005b46b59344abe8c8c7ed98b6f5ba8aa747be92f061f0332b1b839b4685cf2712d53d2054
SSDEEP 768:JkKW/P91NfbQMd/JCyfV8r6w+Bw2HQKBy0I0ZiZ063m1zSXV0OxU4:JkNVP3cQVNw05Pm0Qr32SXuOxU4
TLSH
T12123E806768FCD31E90185B50C97E5FA4B7E6CB02BC23BE7A790267564312D06B7A38D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118__999d8db8668c6098728b3faa4944fde7

File Explorer

jaffacakes118__999d8db8668c6098728b3faa4944fde7

.exe 46KB

jaffacakes118__999d8db8668c6098728b3faa4944fde7

IMPHASH 417855a8c78a70a2772f702e74f8eb4e
SHA256 0c5f3e1d76e7dd1f653043836a225e8803fcac6723433e6269e6b872c8a84a86
MD5 999d8db8668c6098728b3faa4944fde7
SHA1 f56d7a1371a1c7b2d61cb83a8b52568e1cc71834
SHA512 3e2e498b72de33cf98ef6e4d37e8fb2a1b8d61b74d7df5ef3015af005b46b59344abe8c8c7ed98b6f5ba8aa747be92f061f0332b1b839b4685cf2712d53d2054
SSDEEP 768:JkKW/P91NfbQMd/JCyfV8r6w+Bw2HQKBy0I0ZiZ063m1zSXV0OxU4:JkNVP3cQVNw05Pm0Qr32SXuOxU4
TLSH
T12123E806768FCD31E90185B50C97E5FA4B7E6CB02BC23BE7A790267564312D06B7A38D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

28425

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\mmp_koreasys1\module\setup\atlexe\Release\setup.pdb

kernel32

lstrlenA lstrcatA lstrcpyA SetLastError GetLastError CreateRemoteThread GetProcAddress GetExitCodeProcess DuplicateHandle GetCurrentProcess GetModuleHandleA ExpandEnvironmentStringsA MoveFileA DeleteFileA RemoveDirectoryA CreateDirectoryA GetTempPathA GetCommandLineA GetModuleFileNameA GetLocalTime GetTickCount GetSystemTimeAsFileTime GetCurrentProcessId GetFileAttributesExA CreateThread WaitForSingleObject TerminateThread CloseHandle WriteFile CreateMutexA Sleep GetCurrentThreadId QueryPerformanceCounter IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess GetStartupInfoA InterlockedCompareExchange InterlockedExchange

user32

wsprintfA

advapi32

RegQueryValueExA RegOpenKeyExA RegDeleteValueA RegCreateKeyExA RegSetValueExA RegCloseKey RegOpenKeyA

shell32

ShellExecuteA

ole32

CoInitialize

oleaut32

SysFreeString

shlwapi

PathGetArgsA PathFileExistsA PathIsDirectoryA PathRemoveBlanksA PathFindFileNameA

msvcp90

?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z

ws2_32

send __WSAFDIsSet recv connect ioctlsocket htons select closesocket socket gethostbyname WSAStartup

netapi32

Netbios

msvcr90

_except_handler4_common _invoke_watson _controlfp_s ?_type_info_dtor_internal_method@type_info@@QAEXXZ _crt_debugger_hook __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _configthreadlocale _initterm_e _initterm _acmdln _stricmp exit ??3@YAXPAX@Z __CxxFrameHandler3 memcpy vsprintf fclose fwrite fopen sprintf atoi strncpy strstr memset isalpha tolower rand strtok srand _invalid_parameter_noinfo _CxxThrowException ??0exception@std@@QAE@ABV01@@Z ??1exception@std@@UAE@XZ ??0exception@std@@QAE@XZ ??2@YAPAXI@Z ??0exception@std@@QAE@ABQBD@Z ?what@exception@std@@UBEPBDXZ ??_V@YAXPAX@Z _unlock __dllonexit _encode_pointer _lock _onexit _decode_pointer ?terminate@@YAXXZ _amsg_exit __getmainargs _cexit _exit _XcptFilter _ismbblead

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118__999d8db8668c6098728b3faa4944fde7

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

msvcp90

ws2_32

netapi32

msvcr90

generic