jaffacakes118_Trojan-Dropper[.]Win32[.]Agent[.]ack[.]d668c9b739d0e1ba10636a6c76647a7a

General

Target
jaffacakes118_Trojan-Dropper.Win32.Agent.ack.d668c9b739d0e1ba10636a6c76647a7a
Size 85KB
Sample261006-shffdacw7r
SHA256 d6c8e4ec3d74f7d1d7a40216c0dc07f489300b642e71380d0db21864a80fb62e
MD5 d668c9b739d0e1ba10636a6c76647a7a
SHA1 36c1255f342080ce76e769c27b23ce64a69ce8b9
SHA512 0d047920037d2026c45d3d639cb214af762884823877133c117bc00b44bae0ef473dafd9d6997e6e343a4a84d27c217528f74faa896e53412d658d62c22737fa
SSDEEP 1536:BfRCemhP4iIZ9hWFsCJA+vUEWW/6Qid12HWT3E46mNNS:rmhwiIZHWFs8rWW/6ddkH23P62S
TLSH
T16283E1638AEC0416F4B22F3819364A15AB39BC5D9BB9DACF03145DAE34711129DF437B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan-Dropper.Win32.Agent.ack.d668c9b739d0e1ba10636a6c76647a7a

File Explorer

jaffacakes118_Trojan-Dropper.Win32.Agent.ack.d668c9b739d0e1ba10636a6c76647a7a

.exe 85KB

jaffacakes118_Trojan-Dropper.Win32.Agent.ack.d668c9b739d0e1ba10636a6c76647a7a

IMPHASH 92e3313e0245804c3d8b3865fd7cb55f
SHA256 d6c8e4ec3d74f7d1d7a40216c0dc07f489300b642e71380d0db21864a80fb62e
MD5 d668c9b739d0e1ba10636a6c76647a7a
SHA1 36c1255f342080ce76e769c27b23ce64a69ce8b9
SHA512 0d047920037d2026c45d3d639cb214af762884823877133c117bc00b44bae0ef473dafd9d6997e6e343a4a84d27c217528f74faa896e53412d658d62c22737fa
SSDEEP 1536:BfRCemhP4iIZ9hWFsCJA+vUEWW/6Qid12HWT3E46mNNS:rmhwiIZHWFs8rWW/6ddkH23P62S
TLSH
T16283E1638AEC0416F4B22F3819364A15AB39BC5D9BB9DACF03145DAE34711129DF437B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

9599

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

mfc42

ord3081 ord2976 ord3830 ord3831 ord3825 ord3079 ord4080 ord4622 ord4424 ord3738 ord561 ord825 ord2985 ord860 ord540 ord941 ord6779 ord926 ord1576 ord3262 ord3136 ord4465 ord3259 ord3147 ord2982 ord1168 ord5714 ord5289 ord5307 ord4698 ord4079 ord2725 ord5302 ord5300 ord3346 ord2396 ord5199 ord1089 ord3922 ord5731 ord2512 ord2554 ord4486 ord6375 ord4274 ord537 ord6877 ord4129 ord858 ord800 ord939 ord815 ord535

msvcrt

_controlfp _except_handler3 __set_app_type __p__fmode __p__commode _adjust_fdiv __CxxFrameHandler _setmbcp __setusermatherr _initterm __getmainargs _acmdln _XcptFilter _exit _onexit __dllonexit time exit

kernel32

LoadResource Sleep CreateFileA WriteFile CloseHandle SizeofResource ReadFile GetModuleFileNameA GetSystemDirectoryA GetModuleHandleA GetStartupInfoA FindResourceA DeleteFileA GetFileSize

user32

MessageBoxA

advapi32

RegQueryValueExA RegCreateKeyExA RegOpenKeyExA RegSetValueExA RegCloseKey RegSetValueA

shell32

SHFileOperationA ShellExecuteA

ole32

CoCreateGuid StringFromGUID2

shlwapi

SHDeleteValueA SHDeleteKeyA

Sharing