jaffacakes118_Trojan-Downloader[.]Win32[.]Upatre[.]gyvr[.]4c586cff484b06245b76ed0781180186

General

Target
jaffacakes118_Trojan-Downloader.Win32.Upatre.gyvr.4c586cff484b06245b76ed0781180186
Size 148KB
Sample261006-rd6lbszzfx
SHA256 05fe6ab73cef8351165d2d50c8789132718c49f790126fb0fe7fcf3445442b20
MD5 4c586cff484b06245b76ed0781180186
SHA1 80123a1446df5815f9a97b74cf42283292e4909b
SHA512 58e7ad6f166b09a9082c6681dd2a7eef1d26257472aa3728c1d050c4e2c7a0595566698a12ea25eee42d0507a2fbc4dd33fd077944412f7a32068ef1ce2fe566
SSDEEP 3072:RjehIWzW7P5+MJEhKLP4br+S/qI+u8qLuS8:Rj076d4uPTI+u8FS8
TLSH
T197E39D7132D08870E5A2463149B4B644377EBCD95B348D87B78C466E7A306F1AE3BAD3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan-Downloader.Win32.Upatre.gyvr.4c586cff484b06245b76ed0781180186

File Explorer

jaffacakes118_Trojan-Downloader.Win32.Upatre.gyvr.4c586cff484b06245b76ed0781180186

.exe 148KB

jaffacakes118_Trojan-Downloader.Win32.Upatre.gyvr.4c586cff484b06245b76ed0781180186

IMPHASH 3e150668544544bceeccf74f54c78fb5
SHA256 05fe6ab73cef8351165d2d50c8789132718c49f790126fb0fe7fcf3445442b20
MD5 4c586cff484b06245b76ed0781180186
SHA1 80123a1446df5815f9a97b74cf42283292e4909b
SHA512 58e7ad6f166b09a9082c6681dd2a7eef1d26257472aa3728c1d050c4e2c7a0595566698a12ea25eee42d0507a2fbc4dd33fd077944412f7a32068ef1ce2fe566
SSDEEP 3072:RjehIWzW7P5+MJEhKLP4br+S/qI+u8qLuS8:Rj076d4uPTI+u8FS8
TLSH
T197E39D7132D08870E5A2463149B4B644377EBCD95B348D87B78C466E7A306F1AE3BAD3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

11161

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetComputerNameExA GetCurrentProcess GetCommConfig GetProcessTimes TerminateThread GetSystemTimeAdjustment TerminateProcess lstrcatA ExitThread GetStdHandle GetHandleInformation GetLastError SetLastError SetProcessAffinityMask VirtualAlloc LoadLibraryA GetProcessWorkingSetSize SetProcessWorkingSetSize OpenJobObjectW GetThreadPriority GetProcessShutdownParameters GetProcessAffinityMask CloseHandle GetTempPathA lstrcpyA GetProcAddress ExitProcess ReadFile SetEndOfFile WriteConsoleW HeapAlloc EncodePointer DecodePointer GetCommandLineW RaiseException RtlUnwind IsProcessorFeaturePresent GetModuleHandleExW AreFileApisANSI MultiByteToWideChar WideCharToMultiByte WriteFile GetModuleFileNameW GetProcessHeap HeapSize IsDebuggerPresent EnterCriticalSection LeaveCriticalSection GetCurrentThreadId HeapFree GetFileType DeleteCriticalSection GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount Sleep TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW LoadLibraryExW IsValidCodePage GetACP GetOEMCP GetCPInfo OutputDebugStringW HeapReAlloc LCMapStringW GetStringTypeW FlushFileBuffers GetConsoleCP GetConsoleMode CreateFileW SetStdHandle SetFilePointerEx ReadConsoleW

gdi32

EndPath

msimg32

AlphaBlend TransparentBlt

Sharing