jaffacakes118_Trojan-Downloader[.]Win32[.]Small[.]anc[.]31d9cf6984aa5f243fceb7a370d5734f

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan-Downloader.Win32.Small.anc.31d9cf6984aa5f243fceb7a370d5734f
Size 21KB
Sample261006-przzlayt4m
SHA256 afbc7dc26200d42327e92072fdeea6975a9990385c811a023b3a6cbd461a8bf4
MD5 31d9cf6984aa5f243fceb7a370d5734f
SHA1 56845233afa6e4c4ab9bb72a9a05b0cf03ded4f6
SHA512 5554a00123c54941045d2104f8dda558aaa80d1d1b81947712d810d98273eab03d4da0d77d58bfe3fbb12118809552ddd52c1ed94990ad2c5989ef69e651408e
SSDEEP 384:hDufMf8XwaZoKRqgWpDIK1Zk+UDWyBTcXKSJAH0:hafMUXwZbhZIK1usK060
TLSH
T14CA23A0B92400CE9E75A3E78B057AE34A76DD1B02FB291C7A77087182EAE643CE1501B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan-Downloader.Win32.Small.anc.31d9cf6984aa5f243fceb7a370d5734f

File Explorer

jaffacakes118_Trojan-Downloader.Win32.Small.anc.31d9cf6984aa5f243fceb7a370d5734f

.dll 21KB

jaffacakes118_Trojan-Downloader.Win32.Small.anc.31d9cf6984aa5f243fceb7a370d5734f

IMPHASH 2d5774d9142ade2abaaebcbf71df82aa
SHA256 afbc7dc26200d42327e92072fdeea6975a9990385c811a023b3a6cbd461a8bf4
MD5 31d9cf6984aa5f243fceb7a370d5734f
SHA1 56845233afa6e4c4ab9bb72a9a05b0cf03ded4f6
SHA512 5554a00123c54941045d2104f8dda558aaa80d1d1b81947712d810d98273eab03d4da0d77d58bfe3fbb12118809552ddd52c1ed94990ad2c5989ef69e651408e
SSDEEP 384:hDufMf8XwaZoKRqgWpDIK1Zk+UDWyBTcXKSJAH0:hafMUXwZbhZIK1usK060
TLSH
T14CA23A0B92400CE9E75A3E78B057AE34A76DD1B02FB291C7A77087182EAE643CE1501B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13506

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

user32

GetWindowTextA GetForegroundWindow GetClassNameA EnumChildWindows wsprintfA

kernel32

CloseHandle CreateDirectoryA CreateFileA CreateFileMappingA CreateThread DeleteFileA DeviceIoControl ExitThread FreeLibrary GetCurrentProcessId GetCurrentThreadId GetFileSize GetLocalTime GetModuleHandleA GetProcAddress GetProcessHeap GetSystemDirectoryA GetTempPathA HeapAlloc HeapFree LoadLibraryA LocalAlloc LocalFree MapViewOfFile OpenProcess RtlZeroMemory ord5 UnmapViewOfFile VirtualAlloc VirtualProtectEx WideCharToMultiByte _llseek _lread _lwrite lstrcatA lstrcmpiA lstrcpyA lstrcpynA lstrlenA Sleep CloseHandle CreateDirectoryA CreateFileA CreateFileMappingA CreateThread DeleteFileA DeviceIoControl ExitThread FreeLibrary GetCurrentProcessId GetCurrentThreadId GetFileSize GetLocalTime GetModuleHandleA GetProcAddress GetProcessHeap GetSystemDirectoryA GetTempPathA HeapAlloc HeapFree LoadLibraryA LocalAlloc LocalFree MapViewOfFile OpenProcess RtlZeroMemory ord5 UnmapViewOfFile VirtualAlloc VirtualProtectEx WideCharToMultiByte _llseek _lread _lwrite lstrcatA lstrcmpiA lstrcpyA lstrcpynA lstrlenA Sleep

advapi32

RegQueryValueExA RegOpenKeyExA RegEnumKeyExA RegCreateKeyA RegCloseKey

wininet

InternetReadFile HttpOpenRequestA InternetQueryDataAvailable

ws2_32

WSACleanup closesocket connect gethostbyname recv send socket WSAStartup

ole32

CoTaskMemFree