jaffacakes118__296029c85370ee21acf43c4871513f2b

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118__296029c85370ee21acf43c4871513f2b
Size 341KB
Sample260920-2sg7dsfl2y
SHA256 526bcaa8f1f87ae4d671da1b9b52696795fb4c842c1a3ffbcb3962e0c28d7b5d
MD5 296029c85370ee21acf43c4871513f2b
SHA1 0636fe852bfd9cf663cf27be35191b538c018338
SHA512 bc21ab10c8885883ba4c81efb697d8d28195a0fff48b5e38f65a133d391dfc47d91afda091d98ff2f4b66af359672735452c3fe336e7fb0db59a5558928b2f3a
SSDEEP 6144:uodRPjt+3ug0+Gh/4NVdk8tiDREkbH2sHaXlFH03CT0OQAi:ZPjtLx+caVDmREkiMqi
TLSH
T1A574BFA2BBD34073DCC32A71593A63359A3FA709172754C397E80ED40D216E5D63E3AA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118__296029c85370ee21acf43c4871513f2b

File Explorer

jaffacakes118__296029c85370ee21acf43c4871513f2b

.exe 341KB

jaffacakes118__296029c85370ee21acf43c4871513f2b

IMPHASH 491bdfdd004664d98db6c950ead3ab3f
SHA256 526bcaa8f1f87ae4d671da1b9b52696795fb4c842c1a3ffbcb3962e0c28d7b5d
MD5 296029c85370ee21acf43c4871513f2b
SHA1 0636fe852bfd9cf663cf27be35191b538c018338
SHA512 bc21ab10c8885883ba4c81efb697d8d28195a0fff48b5e38f65a133d391dfc47d91afda091d98ff2f4b66af359672735452c3fe336e7fb0db59a5558928b2f3a
SSDEEP 6144:uodRPjt+3ug0+Gh/4NVdk8tiDREkbH2sHaXlFH03CT0OQAi:ZPjtLx+caVDmREkiMqi
TLSH
T1A574BFA2BBD34073DCC32A71593A63359A3FA709172754C397E80ED40D216E5D63E3AA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

505052

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\bwa\BonjourWin-75\srcroot\mDNSWindows\SystemService\Win32\Release\mDNSResponder.pdb

ws2_32

closesocket WSAStringToAddressA WSAGetLastError recv listen accept inet_addr WSACreateEvent WSAEventSelect WSACloseEvent WSAEnumNetworkEvents WSAStartup WSACleanup htons connect ioctlsocket getsockname WSARecvFrom socket setsockopt WSAIoctl bind sendto send htonl

iphlpapi

GetIpForwardTable GetAdaptersInfo GetNetworkParams GetPerAdapterInfo GetBestInterface CreateIpForwardEntry DeleteIpForwardEntry GetIpAddrTable

netapi32

NetGetJoinInformation NetShareEnum NetApiBufferFree

powrprof

SetSuspendState

kernel32

GetLastError GetTickCount GetComputerNameExA WideCharToMultiByte SetEvent WaitForMultipleObjects CreateEventW SetWaitableTimer CloseHandle DeviceIoControl CreateFileA GetComputerNameExW GetEnvironmentStringsW GlobalFree GlobalAlloc FreeLibrary LoadLibraryW GetVersionExW CreateWaitableTimerW OpenThread GetCurrentThreadId ResetEvent TerminateThread MultiByteToWideChar GetModuleFileNameW CancelWaitableTimer GetSystemPowerStatus GetFullPathNameW SetConsoleCtrlHandler GetModuleHandleW HeapSetInformation LCMapStringA GetStartupInfoA GetProcAddress Sleep FormatMessageA LCMapStringW HeapSize FreeEnvironmentStringsA GetEnvironmentStrings WaitForSingleObject FreeEnvironmentStringsW GetCommandLineA GetCommandLineW QueryPerformanceCounter GetCurrentProcessId GetStringTypeA GetStringTypeW GetLocaleInfoA InitializeCriticalSection RtlUnwind LoadLibraryA WriteConsoleA GetConsoleOutputCP WriteConsoleW SetFilePointer SetStdHandle QueueUserAPC GetFileType SetHandleCount FlushFileBuffers GetConsoleMode GetConsoleCP GetModuleFileNameA GetStdHandle WriteFile GetSystemTimeAsFileTime HeapAlloc HeapFree EnterCriticalSection LeaveCriticalSection HeapReAlloc ExitThread CreateThread UnhandledExceptionFilter SetUnhandledExceptionFilter GetVersionExA GetProcessHeap TerminateProcess GetCurrentProcess IsDebuggerPresent GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage GetModuleHandleA TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError DeleteCriticalSection VirtualFree VirtualAlloc HeapDestroy HeapCreate ExitProcess

user32

LoadStringW

advapi32

OpenServiceW RegisterServiceCtrlHandlerExW DeregisterEventSource StartServiceCtrlDispatcherW SetServiceStatus QueryServiceStatus ControlService DeleteService CreateServiceW StartServiceW RegNotifyChangeKeyValue RegisterEventSourceW ReportEventA LockServiceDatabase ChangeServiceConfig2W UnlockServiceDatabase OpenSCManagerW EnumServicesStatusW CloseServiceHandle LsaOpenPolicy LsaNtStatusToWinError LsaRetrievePrivateData LsaFreeMemory LsaClose RegOpenKeyExW RegCreateKeyA RegQueryInfoKeyW RegEnumKeyExA RegOpenKeyExA RegQueryValueExA RegQueryValueExW RegCreateKeyW RegSetValueExW RegCloseKey

ole32

CoInitializeEx CoUninitialize CoCreateInstance

oleaut32

SysFreeString SysStringLen SysAllocString

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118__296029c85370ee21acf43c4871513f2b

ws2_32

iphlpapi

netapi32

powrprof

kernel32

user32

advapi32

ole32

oleaut32

generic