jaffacakes118_Trojan-Downloader[.]Win32[.]Small[.]awu[.]7a78a25564200f96c7c585a69f8fd1a2

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan-Downloader.Win32.Small.awu.7a78a25564200f96c7c585a69f8fd1a2
Size 40KB
Sample261006-pyzbmsgx9s
SHA256 3db3f0d8afc9177041a926d3e21da41d881ec152f225ea54c2c8ddd751413a3c
MD5 7a78a25564200f96c7c585a69f8fd1a2
SHA1 6ff10680967c4d5df05cbb8b1da3d813c5d7c4f4
SHA512 17a9312e46b4e39ca97a07481520d120a84ec0942c61fef5343f0072b3e56c9c9a37e14a9735a5cd647e20c1518cf51265d0db38b43d5486952ddda0b7943338
SSDEEP 768:IvjjLy1ABLKRu31lYaPQN8En6XnDJ7SH4rxi1T:Iby1uLx31aaq8Q6XnDgWQ1T
TLSH
T1AB03291E7A78C177D512413022196B3AF1FFEC380625A887DB10BE2D69B5AC3E96531F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan-Downloader.Win32.Small.awu.7a78a25564200f96c7c585a69f8fd1a2

File Explorer

jaffacakes118_Trojan-Downloader.Win32.Small.awu.7a78a25564200f96c7c585a69f8fd1a2

.exe 40KB

jaffacakes118_Trojan-Downloader.Win32.Small.awu.7a78a25564200f96c7c585a69f8fd1a2

IMPHASH 8b0b71896f4156ce371d123ef428b588
SHA256 3db3f0d8afc9177041a926d3e21da41d881ec152f225ea54c2c8ddd751413a3c
MD5 7a78a25564200f96c7c585a69f8fd1a2
SHA1 6ff10680967c4d5df05cbb8b1da3d813c5d7c4f4
SHA512 17a9312e46b4e39ca97a07481520d120a84ec0942c61fef5343f0072b3e56c9c9a37e14a9735a5cd647e20c1518cf51265d0db38b43d5486952ddda0b7943338
SSDEEP 768:IvjjLy1ABLKRu31lYaPQN8En6XnDJ7SH4rxi1T:Iby1uLx31aaq8Q6XnDgWQ1T
TLSH
T1AB03291E7A78C177D512413022196B3AF1FFEC380625A887DB10BE2D69B5AC3E96531F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

22246

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

mfc42

ord4202 ord6283 ord860 ord540 ord825 ord537 ord858 ord356 ord2770 ord2820 ord2781 ord3010 ord2822 ord668 ord800 ord3811 ord2763 ord5683 ord4278 ord6662 ord4129 ord823 ord535

msvcrt

__setusermatherr _adjust_fdiv __p__commode __p__fmode __set_app_type _controlfp _initterm __getmainargs _acmdln exit _XcptFilter _exit ?terminate@@YAXXZ _except_handler3 __dllonexit malloc strcmp _mbsrchr time srand rand strncpy memset strcat fprintf strstr atoi getenv _findfirst _findnext strcpy _findclose strlen _EH_prolog __CxxFrameHandler sprintf fopen fgets _mbscmp fclose _onexit

kernel32

GetModuleHandleA SleepEx GetModuleFileNameA CopyFileA CreateProcessA MultiByteToWideChar ResumeThread SetPriorityClass GetCurrentProcess GetCurrentThread SetThreadPriority CloseHandle WriteFile lstrlenA lstrcpyA CreateFileA Process32Next Process32First CreateToolhelp32Snapshot GetCurrentProcessId LoadLibraryA FreeLibrary GetProcAddress GetStartupInfoA DeleteFileA Sleep

user32

GetClassNameA MessageBoxA EnumChildWindows GetDesktopWindow wsprintfA SendMessageA

advapi32

RegCloseKey RegDeleteKeyA RegDeleteValueA RegCreateKeyExA RegSetValueExA RegOpenKeyExA RegQueryValueExA

shell32

SHGetPathFromIDListA SHGetSpecialFolderLocation ShellExecuteA

ole32

CoInitialize CoCreateInstance

urlmon

URLDownloadToFileA