jaffacakes118_Trojan-Downloader[.]Win32[.]Small[.]alj[.]666e2b2ae973bc8f8274e474b4a22c19

General

Target
jaffacakes118_Trojan-Downloader.Win32.Small.alj.666e2b2ae973bc8f8274e474b4a22c19
Size 16KB
Sample261006-pq3zvsbs8q
SHA256 94dfa25a40f31eb97be16988f43394a9b528c395fabb09b8d0233863da9cd086
MD5 666e2b2ae973bc8f8274e474b4a22c19
SHA1 d2ba26f9bb38b2fe3ba739eb2448e3ad7aa8fd03
SHA512 3edbe4d38229e1f3eb0d326b90becfd933e989a2fb3eebbe2e093a32b207f16472f3dd5ed4b31d7ad715615012dda8b123ee926774992e8518ff6f9c4f2be0b0
SSDEEP 192:aPF0osslJaVilTk42l35mNN32wLQ61JPL9SWObVhjQ7mYkw+3i4oePXHdc:4uOkZ35mNNfLQML98bVhk7mYkw+3v
TLSH
T1887209439E4514F6FC52153611AF3777963B8245A1A2ED63D728EC8128B3143E5FB38A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan-Downloader.Win32.Small.alj.666e2b2ae973bc8f8274e474b4a22c19

File Explorer

jaffacakes118_Trojan-Downloader.Win32.Small.alj.666e2b2ae973bc8f8274e474b4a22c19

.dll 16KB

jaffacakes118_Trojan-Downloader.Win32.Small.alj.666e2b2ae973bc8f8274e474b4a22c19

IMPHASH 8a33c8503a77f534814e7d68f69db91e
SHA256 94dfa25a40f31eb97be16988f43394a9b528c395fabb09b8d0233863da9cd086
MD5 666e2b2ae973bc8f8274e474b4a22c19
SHA1 d2ba26f9bb38b2fe3ba739eb2448e3ad7aa8fd03
SHA512 3edbe4d38229e1f3eb0d326b90becfd933e989a2fb3eebbe2e093a32b207f16472f3dd5ed4b31d7ad715615012dda8b123ee926774992e8518ff6f9c4f2be0b0
SSDEEP 192:aPF0osslJaVilTk42l35mNN32wLQ61JPL9SWObVhjQ7mYkw+3i4oePXHdc:4uOkZ35mNNfLQML98bVhk7mYkw+3v
TLSH
T1887209439E4514F6FC52153611AF3777963B8245A1A2ED63D728EC8128B3143E5FB38A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5968

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

shlwapi

SHDeleteKeyA

kernel32

GetProcAddress GetModuleHandleA lstrcmpiA ExitProcess GetModuleFileNameA GetCurrentProcessId TerminateThread GetCurrentThread DisableThreadLibraryCalls CreateThread lstrcpyA HeapFree GetProcessHeap WinExec UnmapViewOfFile GetSystemDirectoryA Sleep GetLastError CreateEventA HeapAlloc GetTickCount GetCurrentThreadId lstrlenA lstrcpynA CloseHandle GetThreadContext OpenEventA LoadLibraryA MapViewOfFileEx CreateFileMappingA lstrcmpA VirtualProtect HeapReAlloc GetCurrentProcess FreeLibrary VirtualProtectEx GetVersionExA CreateFileA WaitForSingleObject DeleteFileA CopyFileA GetFileAttributesA GetFileSize MapViewOfFile ResumeThread CreateProcessA DuplicateHandle RemoveDirectoryA WriteProcessMemory FlushInstructionCache SetThreadContext PulseEvent

user32

GetMessageA DispatchMessageA TranslateMessage wsprintfA

advapi32

RegQueryValueExA RegCloseKey RegCreateKeyExA RegSetValueExA RegDeleteValueA RegEnumValueA RegOpenKeyExA

wininet

InternetCloseHandle InternetReadFile InternetQueryDataAvailable HttpQueryInfoA InternetOpenUrlA InternetCanonicalizeUrlA InternetOpenA

Sharing