jaffacakes118_Trojan-Downloader[.]Win32[.]Upatre[.]hlkg[.]310eb904ed86b4684ba858e28db0caff

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan-Downloader.Win32.Upatre.hlkg.310eb904ed86b4684ba858e28db0caff
Size 195KB
Sample261006-refrascs3n
SHA256 55f631396eeca9e1fed73edef966490113e7a1ff6746820a51363ef337f5fb6d
MD5 310eb904ed86b4684ba858e28db0caff
SHA1 b3e20ed3548537d4711fb4619c84d3df6a3c8a3f
SHA512 367b0d9d70dd100616adae9227867f3c46c3b5e0410203ec6ebc2ecec118d3b512622bcf49f0a0b069d6b671248b9028b9777feff57971c22b6764220a73157b
SSDEEP 3072:AlRopAle5N4Z8TRU4KQTpc5vL9+aeOlo88xQeat5xtFO85:AYph5N4Z89UFQTpc5vL9+aeOOHQ5TOy
TLSH
T1A3144A38AEE0D137C1B791BA84F157A7BE61B531331058CBA39507564E22BE3BA7530E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan-Downloader.Win32.Upatre.hlkg.310eb904ed86b4684ba858e28db0caff

File Explorer

jaffacakes118_Trojan-Downloader.Win32.Upatre.hlkg.310eb904ed86b4684ba858e28db0caff

.exe 195KB

jaffacakes118_Trojan-Downloader.Win32.Upatre.hlkg.310eb904ed86b4684ba858e28db0caff

IMPHASH e6604fdfab3b53fe4d3c084e1718b5dc
SHA256 55f631396eeca9e1fed73edef966490113e7a1ff6746820a51363ef337f5fb6d
MD5 310eb904ed86b4684ba858e28db0caff
SHA1 b3e20ed3548537d4711fb4619c84d3df6a3c8a3f
SHA512 367b0d9d70dd100616adae9227867f3c46c3b5e0410203ec6ebc2ecec118d3b512622bcf49f0a0b069d6b671248b9028b9777feff57971c22b6764220a73157b
SSDEEP 3072:AlRopAle5N4Z8TRU4KQTpc5vL9+aeOlo88xQeat5xtFO85:AYph5N4Z89UFQTpc5vL9+aeOOHQ5TOy
TLSH
T1A3144A38AEE0D137C1B791BA84F157A7BE61B531331058CBA39507564E22BE3BA7530E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

68337

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LockResource LoadResource FindResourceW FindResourceExW VirtualQuery FindFirstFileW FindNextFileW FindClose GetTickCount CreateToolhelp32Snapshot Process32FirstW OpenProcess Process32NextW GetProcAddress LoadLibraryW GetSystemDirectoryW SetCurrentDirectoryW ProcessIdToSessionId GetCurrentProcessId Sleep CreateProcessW TerminateProcess LoadLibraryA GetVersionExW HeapDestroy HeapAlloc HeapFree HeapReAlloc SizeofResource GetProcessHeap RaiseException EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection WideCharToMultiByte MultiByteToWideChar GetModuleFileNameW GetCurrentThread SetThreadPriority SetPriorityClass ExitProcess SetUnhandledExceptionFilter GetModuleHandleW CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA FlushFileBuffers SetStdHandle GetLocaleInfoA GetStringTypeW GetStringTypeA GetCurrentProcess CloseHandle OpenMutexW GetLastError HeapSize CreateMutexW InitializeCriticalSectionAndSpinCount GetConsoleMode GetConsoleCP LCMapStringA ReadFile SetFilePointer VirtualFreeEx VirtualAllocEx GetSystemInfo GetModuleHandleA WriteProcessMemory CreateRemoteThread GetProcessId VirtualFree VirtualAlloc WriteFile SystemTimeToFileTime GetCurrentDirectoryW LocalFileTimeToFileTime GetStartupInfoW UnhandledExceptionFilter IsDebuggerPresent RtlUnwind GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement HeapCreate QueryPerformanceCounter GetSystemTimeAsFileTime GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringW

user32

wsprintfW

advapi32

CheckTokenMembership OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges CreateProcessAsUserW FreeSid AllocateAndInitializeSid

shell32

ShellExecuteExW ShellExecuteW

shlwapi

PathFileExistsW StrCmpIW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

wininet

InternetConnectW InternetOpenW HttpOpenRequestW InternetSetOptionA InternetQueryOptionW InternetSetOptionW HttpSendRequestW InternetReadFile InternetCloseHandle

dnsapi

DnsFree DnsQuery_W

iphlpapi

GetAdaptersInfo SendARP

ws2_32

inet_ntoa gethostbyname WSAStartup htonl inet_addr ntohl