jaffacakes118_Trojan-Downloader[.]Win32[.]Upatre[.]hvcp[.]079104410fabeb265bc135d570f2c6d3

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan-Downloader.Win32.Upatre.hvcp.079104410fabeb265bc135d570f2c6d3
Size 516KB
Sample261006-rexd2sy15n
SHA256 0400189bd132c7f37f7afd7ddcc9dce8d5e28c7282a395438a978b8693a9d886
MD5 079104410fabeb265bc135d570f2c6d3
SHA1 99cfe50e5d0e36600318591e4774092d651dffb8
SHA512 65279043277aaf89ae60e365d04b2bc38b44978ce5bcca3c881e882fa9bee855505dc504a009c8e2ab88a7656a9bc63dc83808f800be00ee2e84df036faf2a13
SSDEEP 6144:IZeuhHGNPzmOMMS2/stnu1u8KoNAgBerApTS8QtBIuZQbyX6g5l4x/d+y8XD3:IZrHGNhlwAEJWmha/dEz
TLSH
T182B401AFA3C552F1D19A3BF25CD6863FC783ACE6079884C34754FF22A9B21228727155
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan-Downloader.Win32.Upatre.hvcp.079104410fabeb265bc135d570f2c6d3

File Explorer

jaffacakes118_Trojan-Downloader.Win32.Upatre.hvcp.079104410fabeb265bc135d570f2c6d3

.exe 516KB

jaffacakes118_Trojan-Downloader.Win32.Upatre.hvcp.079104410fabeb265bc135d570f2c6d3

IMPHASH 319612d186a5687e3790989f1e2e9235
SHA256 0400189bd132c7f37f7afd7ddcc9dce8d5e28c7282a395438a978b8693a9d886
MD5 079104410fabeb265bc135d570f2c6d3
SHA1 99cfe50e5d0e36600318591e4774092d651dffb8
SHA512 65279043277aaf89ae60e365d04b2bc38b44978ce5bcca3c881e882fa9bee855505dc504a009c8e2ab88a7656a9bc63dc83808f800be00ee2e84df036faf2a13
SSDEEP 6144:IZeuhHGNPzmOMMS2/stnu1u8KoNAgBerApTS8QtBIuZQbyX6g5l4x/d+y8XD3:IZrHGNhlwAEJWmha/dEz
TLSH
T182B401AFA3C552F1D19A3BF25CD6863FC783ACE6079884C34754FF22A9B21228727155
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

26663

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

shell32

SHBrowseForFolderW SHBrowseForFolderA DragQueryFileW SHGetFileInfoW SHGetSpecialFolderPathA ShellExecuteExW SHGetPathFromIDListW SHFileOperationA

user32

MapWindowPoints GetIconInfo DdeKeepStringHandle

comdlg32

GetOpenFileNameW GetSaveFileNameW GetOpenFileNameA Ssync_ANSI_UNICODE_Struct_For_WOW dwLBSubclass GetSaveFileNameA

kernel32

CreateDirectoryExA FreeEnvironmentStringsW GetLongPathNameW GetCommandLineW GetFileAttributesA HeapSize SetUnhandledExceptionFilter LoadLibraryExA GetModuleFileNameW QueryPerformanceFrequency ExitProcess MoveFileW SetEvent SetHandleCount SetStdHandle GetDateFormatA FindFirstFileA GetVersionExA EnterCriticalSection CreateDirectoryW ReadProcessMemory QueryPerformanceCounter GetModuleFileNameA GetStringTypeW RemoveDirectoryW RemoveDirectoryA CopyFileExW FindFirstFileExA CreateProcessA GetStdHandle CompareStringW WaitForMultipleObjects RaiseException InitializeCriticalSection IsValidCodePage MoveFileA GetCurrentProcess CreateProcessW MulDiv HeapAlloc InterlockedIncrement SetEndOfFile FlushFileBuffers GetVersion GetFileAttributesW SetFilePointer FindNextFileA GetCurrentProcessId SetEnvironmentVariableA HeapReAlloc FindNextFileW GetProcessHeap LoadLibraryW CreateFileW TlsFree VirtualFree FindFirstFileW GetModuleHandleW TlsSetValue MoveFileExA GetThreadPriority ResetEvent CompareStringA GetCPInfo RtlUnwind InterlockedExchange LeaveCriticalSection FreeEnvironmentStringsA SetThreadPriority DeleteFileA GetOEMCP CopyFileW OpenEventA HeapFree CreateEventA InterlockedDecrement TlsAlloc HeapCreate GetFileAttributesExW MoveFileWithProgressW FindFirstChangeNotificationW CreateThread GetFileType LoadLibraryA GetStringTypeA GetLongPathNameA WriteProcessMemory DeleteFileW CreateDirectoryA TlsGetValue WaitForSingleObject MoveFileExW GetFileAttributesExA GetStartupInfoA InterlockedCompareExchange FreeLibrary GetACP IsDebuggerPresent CloseHandle GetLastError OpenProcess WriteFile DeleteCriticalSection FindFirstChangeNotificationA Sleep CreateFileA GetModuleHandleA GetConsoleMode WriteConsoleA GetDateFormatW SetErrorMode LCMapStringW ReadFile GetCommandLineA LoadLibraryExW GetProcAddress

gdi32

GetFontLanguageInfo DeleteObject

advapi32

RegOpenCurrentUser IsTextUnicode

imm32

ImmGetProperty ImmDisableIME ImmGetStatusWindowPos ImmSimulateHotKey

ddraw

GetSurfaceFromDC DDInternalUnlock DSoundHelp

dsound

ord6 ord9 ord10

winmm

timeBeginPeriod timeSetEvent mmioDescend mciGetErrorStringA GetDriverModuleHandle waveOutMessage mmioOpenA midiOutPrepareHeader mciSendStringA mciSetDriverData midiStreamRestart

comctl32

DestroyPropertySheetPage ImageList_SetFilter ord17 CreatePropertySheetPageA FlatSB_ShowScrollBar PropertySheetW FlatSB_SetScrollInfo ord3 ImageList_BeginDrag

dinput

DirectInputCreateEx

oleaut32

SafeArrayGetElement VarCyFromUI4 VarFormatPercent SysAllocString SysFreeString

msvfw32

ICDrawBegin ICSendMessage DrawDibEnd ICCompressorFree ICOpen

avifil32

EditStreamSetInfoW EditStreamSetInfoA AVIStreamSetFormat AVIStreamWriteData AVIClearClipboard AVIStreamInfoW AVIStreamTimeToSample AVIMakeStreamFromClipboard AVIStreamFindSample EditStreamPaste AVIMakeCompressedStream AVIStreamGetFrameOpen AVIStreamOpenFromFileW AVIStreamBeginStreaming AVIFileOpenW AVISaveW EditStreamCopy AVIStreamInfoA AVIFileCreateStreamW IID_IAVIStream AVIFileRelease AVISaveA AVIPutFileOnClipboard AVIFileEndRecord AVIStreamAddRef CreateEditableStream AVIGetFromClipboard AVIFileOpenA AVIBuildFilterW IID_IGetFrame AVIStreamWrite AVIStreamRead AVIStreamGetFrame AVISaveOptionsFree AVIFileInfoA AVIFileCreateStreamA AVIFileWriteData AVIFileAddRef AVIStreamGetFrameClose AVISaveOptions EditStreamSetNameW EditStreamClone AVIStreamStart AVIFileReadData AVIFileInit AVIFileInfoW IID_IAVIFile IID_IAVIEditStream AVIFileGetStream AVIBuildFilterA AVIFileExit AVIStreamReadData AVISaveVW AVIStreamLength EditStreamCut AVIStreamOpenFromFileA AVIStreamCreate AVISaveVA AVIStreamEndStreaming AVIStreamReadFormat EditStreamSetNameA AVIStreamRelease AVIMakeFileFromStreams AVIStreamSampleToTime

Name

.text

Size

81KB

Virtual Size

84KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

76KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

327KB

Virtual Size

327KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_Trojan-Downloader.Win32.Upatre.hvcp.079104410fabeb265bc135d570f2c6d3

shell32

user32

comdlg32

kernel32

gdi32

advapi32

imm32

ddraw

dsound

winmm

comctl32

dinput

oleaut32

msvfw32

avifil32

generic