jaffacakes118__a1d43839adedc76f34e6c4d896e38932

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118__a1d43839adedc76f34e6c4d896e38932
Size 208KB
Sample260919-vplbbavvhx
SHA256 99af7e9372999a79cfc4dfd3c0e5a95d64015f1f2e5b6b4fc1fe875b1ba6b10e
MD5 a1d43839adedc76f34e6c4d896e38932
SHA1 d53c26774a8dc3e132eea3f9095effa902e1c418
SHA512 40c5bf666f7cc0f67faf557af77d98b46693414cd2ab52f9d6e08887153feb3cc1ad195d888976564cfbd93860f0f622a3894ca6b2f8f0d198be8cc7cccd8c5e
SSDEEP 3072:7FSd4ubm3tbpiTtAbP/ykrSfFTyMBfmtKj5Sd3W:xzHHD/y+SfFTxBOsodm
TLSH
T11924393D73A1C0BECC4710740CE9D7A5EE2AAEA00B1559F3B3952BAD5E312F2593918D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118__a1d43839adedc76f34e6c4d896e38932

File Explorer

jaffacakes118__a1d43839adedc76f34e6c4d896e38932

.exe 208KB

jaffacakes118__a1d43839adedc76f34e6c4d896e38932

IMPHASH fda18323696d5cc409b645e632c24308
SHA256 99af7e9372999a79cfc4dfd3c0e5a95d64015f1f2e5b6b4fc1fe875b1ba6b10e
MD5 a1d43839adedc76f34e6c4d896e38932
SHA1 d53c26774a8dc3e132eea3f9095effa902e1c418
SHA512 40c5bf666f7cc0f67faf557af77d98b46693414cd2ab52f9d6e08887153feb3cc1ad195d888976564cfbd93860f0f622a3894ca6b2f8f0d198be8cc7cccd8c5e
SSDEEP 3072:7FSd4ubm3tbpiTtAbP/ykrSfFTyMBfmtKj5Sd3W:xzHHD/y+SfFTxBOsodm
TLSH
T11924393D73A1C0BECC4710740CE9D7A5EE2AAEA00B1559F3B3952BAD5E312F2593918D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

101008

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\mmp\source\setup\IEKeyword_EXE\setup\IEKeyword_EXE\Release\setup.pdb

kernel32

SetEvent WideCharToMultiByte lstrlenW GetModuleFileNameA SetLastError GetLastError lstrcmpA MulDiv CloseHandle CreateRemoteThread GetProcAddress GetExitCodeProcess DuplicateHandle lstrcatA lstrcpyA ExpandEnvironmentStringsA GetTickCount lstrcmpiA CreateMutexA RemoveDirectoryA CreateDirectoryA GetTempPathA GetCurrentProcessId OpenProcess MoveFileA DeleteFileA GetCommandLineA GetLocalTime IsProcessorFeaturePresent InterlockedCompareExchange ReadFile GetProcessHeap SetEndOfFile GetLocaleInfoA InterlockedDecrement GetStringTypeW GetStringTypeA LoadLibraryA FlushFileBuffers SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA InitializeCriticalSectionAndSpinCount CreateFileA SetFilePointer GetSystemTimeAsFileTime QueryPerformanceCounter GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA HeapSize LCMapStringW LCMapStringA IsValidCodePage GetOEMCP GetACP GetCPInfo TlsFree TlsSetValue TlsAlloc TlsGetValue GetStdHandle ExitProcess VirtualFree HeapCreate GetConsoleMode GetConsoleCP WriteFile GetStartupInfoA ResumeThread InterlockedIncrement GlobalAlloc GlobalLock GlobalUnlock lstrlenA GetModuleHandleA GetCurrentThreadId Sleep GetCurrentProcess GetFileAttributesExA FlushInstructionCache DeleteCriticalSection InitializeCriticalSection LeaveCriticalSection EnterCriticalSection RaiseException MultiByteToWideChar WaitForSingleObject CreateThread HeapFree HeapAlloc ExitThread HeapReAlloc VirtualQuery GetSystemInfo GetModuleHandleW VirtualAlloc VirtualProtect IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess RtlUnwind

user32

GetWindowLongA SetWindowLongA SendMessageA GetClassInfoExA LoadCursorA DefWindowProcA SetWindowTextA MoveWindow ClientToScreen SetWindowPos IsWindowVisible ShowWindow GetWindowTextA GetWindowTextLengthA PostThreadMessageA CreateWindowExA RegisterClassExA RegisterWindowMessageA LoadBitmapA GetClientRect BeginPaint EndPaint CallWindowProcA FillRect GetSysColor CharNextA wsprintfA MessageBoxA BringWindowToTop PeekMessageA TranslateMessage DispatchMessageA FindWindowExA GetWindowThreadProcessId AttachThreadInput GetCursorPos GetForegroundWindow WindowFromPoint SetLayeredWindowAttributes GetWindowRect CreateAcceleratorTableA IsWindow GetDesktopWindow SetFocus GetFocus GetWindow DestroyAcceleratorTable DestroyWindow ReleaseCapture GetClassNameA GetDlgItem GetParent IsChild SetCapture RedrawWindow InvalidateRgn InvalidateRect ReleaseDC GetDC ScreenToClient UnregisterClassA

gdi32

GetDeviceCaps CreateCompatibleBitmap DeleteObject GetStockObject CreateCompatibleDC SelectObject BitBlt DeleteDC GetObjectA CreateSolidBrush

advapi32

RegDeleteValueA RegOpenKeyA RegOpenKeyExA RegQueryValueExA RegCreateKeyExA RegSetValueExA RegCloseKey RegDeleteKeyA

shell32

ShellExecuteA

ole32

CoInitializeEx CLSIDFromString CLSIDFromProgID CoGetClassObject CoTaskMemAlloc OleLockRunning StringFromGUID2 CoCreateInstance OleUninitialize OleInitialize CreateStreamOnHGlobal CoUninitialize CoInitialize

oleaut32

SysStringLen SysFreeString SysAllocStringLen SysAllocString VariantInit VariantClear DispCallFunc LoadRegTypeLi LoadTypeLi OleCreateFontIndirect

shlwapi

PathIsDirectoryA PathRemoveBlanksA PathRemoveFileSpecA PathGetArgsA StrStrIW StrToIntA UrlUnescapeA PathFileExistsA PathFindFileNameA

ws2_32

htons ioctlsocket connect select __WSAFDIsSet closesocket send recv gethostbyname WSAStartup socket

netapi32

Netbios

psapi

EnumProcesses GetModuleFileNameExA

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118__a1d43839adedc76f34e6c4d896e38932

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

ws2_32

netapi32

psapi

generic