jaffacakes118_Trojan-Downloader[.]Win32[.]Upatre[.]idux[.]801ea38bf5a3a5d3962ca1f0710cf867

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan-Downloader.Win32.Upatre.idux.801ea38bf5a3a5d3962ca1f0710cf867
Size 367KB
Sample261006-rftpjszzhs
SHA256 ad612c6d87df0f5002b0c8ba06b59d3ca50b3d02e0a9ff89667cc3be1fbb7e47
MD5 801ea38bf5a3a5d3962ca1f0710cf867
SHA1 abdf58ec631ef4954ce082c97b54f5d3cf7bafd6
SHA512 0c0336f2d9f770dbf1f0cde71ac553303a06b08f024e672ae137bf31a758a3e5f2eb7e7369289b44d2b950af038575f4fa0d8ebedfef22690046f590752d7c79
SSDEEP 6144:ihfKLHT3HToO3zqN8Fp+IWKcMP8/Zyfc7mkFP+DwlrhgXJgEM3C:j3HToVWHtc08Ua2Dw5uXTKC
TLSH
T1FB84F187B3C251F0E7AB15F91C96A33FC3239D9A9BA582C39794EE1775B3201815B270
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan-Downloader.Win32.Upatre.idux.801ea38bf5a3a5d3962ca1f0710cf867

File Explorer

jaffacakes118_Trojan-Downloader.Win32.Upatre.idux.801ea38bf5a3a5d3962ca1f0710cf867

.exe 367KB

jaffacakes118_Trojan-Downloader.Win32.Upatre.idux.801ea38bf5a3a5d3962ca1f0710cf867

IMPHASH a4f7a574b59dc381725a8e848eeea8f2
SHA256 ad612c6d87df0f5002b0c8ba06b59d3ca50b3d02e0a9ff89667cc3be1fbb7e47
MD5 801ea38bf5a3a5d3962ca1f0710cf867
SHA1 abdf58ec631ef4954ce082c97b54f5d3cf7bafd6
SHA512 0c0336f2d9f770dbf1f0cde71ac553303a06b08f024e672ae137bf31a758a3e5f2eb7e7369289b44d2b950af038575f4fa0d8ebedfef22690046f590752d7c79
SSDEEP 6144:ihfKLHT3HToO3zqN8Fp+IWKcMP8/Zyfc7mkFP+DwlrhgXJgEM3C:j3HToVWHtc08Ua2Dw5uXTKC
TLSH
T1FB84F187B3C251F0E7AB15F91C96A33FC3239D9A9BA582C39794EE1775B3201815B270
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

14348

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

tapi32

phoneSetGain lineConfigProvider

comctl32

ImageList_Merge

user32

SetClassLongA CheckDlgButton SystemParametersInfoA CreateWindowExA CharPrevA LoadCursorA LoadImageA GetClassInfoA PeekMessageA SetDlgItemTextA SetCursor wsprintfA SetWindowTextA EndPaint CreateDialogParamA RegisterClassA ShowWindow AppendMenuA GetDlgItemTextA GetMessagePos CreatePopupMenu IsWindowEnabled EmptyClipboard CloseClipboard OpenClipboard DialogBoxParamA SetClipboardData LoadBitmapA DefWindowProcA GetWindowRect FillRect InvalidateRect GetDlgItem GetSysColor GetSystemMetrics GetDC SendMessageTimeoutA ScreenToClient IsWindowVisible DispatchMessageA SendMessageA FindWindowExA GetSystemMenu SetWindowPos DrawTextA GetClientRect BeginPaint

advapi32

RegQueryValueExA RegCloseKey

kernel32

CloseHandle FindClose GetWindowsDirectoryA FindFirstFileA GetProcAddress SearchPathA FreeLibrary GetLastError GlobalAlloc SetFileTime CompareFileTime FindNextFileA WaitForSingleObject SetFilePointer GetModuleHandleA ExpandEnvironmentStringsA GetCurrentProcess GetTickCount ExitProcess GetFileAttributesA WritePrivateProfileStringA GetTempPathA SetCurrentDirectoryA GetModuleFileNameA ReadFile WriteFile MoveFileA RemoveDirectoryA LoadLibraryA GlobalFree CreateFileA Sleep GetFullPathNameA DeleteFileA GlobalUnlock GetFileSize GetShortPathNameA GetVersion CreateThread MulDiv GetExitCodeProcess GetDiskFreeSpaceA GetTempFileNameA

Name

.text

Size

76KB

Virtual Size

80KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

155KB

Virtual Size

154KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

107KB

Virtual Size

107KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.crt

Size

512B

Virtual Size

54B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_Trojan-Downloader.Win32.Upatre.idux.801ea38bf5a3a5d3962ca1f0710cf867

tapi32

comctl32

user32

advapi32

kernel32

generic