jaffacakes118_Trojan-Dropper[.]Win32[.]Agent[.]bjrroi[.]21ce1ece732132d082a1c5f24757e764

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan-Dropper.Win32.Agent.bjrroi.21ce1ece732132d082a1c5f24757e764
Size 1.3MB
Sample261006-sshngscy5l
SHA256 601cb14ee12642b5f5ec6be89e7297d1e168b661965f2d1a02ee575e08e0f8c9
MD5 21ce1ece732132d082a1c5f24757e764
SHA1 f7610707c01576d2e94e092fa2cc77804980ec55
SHA512 6494fbfc6f5a3377f141cc233042b3bb9ea1b02e9e20c4eb34a5c01d19f7669513fb41576d1060817093bb40b336f20f2ec6cd8ae8647bcc3bea9488d8b9c0ce
SSDEEP 24576:qiI44YE326KBq7NN47tPEwx9x9WTkqJUb:f4YbBq7NO7lEwx9KTnJG
TLSH
T103558D92FAD28AB2D872153189F74B261B35FEA1475997D363E0346D1C3A3D03E7A348
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan-Dropper.Win32.Agent.bjrroi.21ce1ece732132d082a1c5f24757e764

File Explorer

jaffacakes118_Trojan-Dropper.Win32.Agent.bjrroi.21ce1ece732132d082a1c5f24757e764

.exe 1.3MB

jaffacakes118_Trojan-Dropper.Win32.Agent.bjrroi.21ce1ece732132d082a1c5f24757e764

IMPHASH f4611dec9e5901a814382e2d34666279
SHA256 601cb14ee12642b5f5ec6be89e7297d1e168b661965f2d1a02ee575e08e0f8c9
MD5 21ce1ece732132d082a1c5f24757e764
SHA1 f7610707c01576d2e94e092fa2cc77804980ec55
SHA512 6494fbfc6f5a3377f141cc233042b3bb9ea1b02e9e20c4eb34a5c01d19f7669513fb41576d1060817093bb40b336f20f2ec6cd8ae8647bcc3bea9488d8b9c0ce
SSDEEP 24576:qiI44YE326KBq7NN47tPEwx9x9WTkqJUb:f4YbBq7NO7lEwx9KTnJG
TLSH
T103558D92FAD28AB2D872153189F74B261B35FEA1475997D363E0346D1C3A3D03E7A348
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

377774

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

InterlockedDecrement IsBadWritePtr lstrlenW FatalAppExitA DebugBreak lstrcpyW FindResourceA FreeResource LoadResource GetCurrentProcess SizeofResource GetConsoleWindow LockResource CloseHandle CreateFileA ReadFile VirtualFree FreeLibrary WaitForSingleObject CreateRemoteThread OpenProcess VirtualFreeEx ReadProcessMemory GetProcAddress VirtualAlloc VirtualAllocEx LoadLibraryA GetSystemInfo GetCurrentThreadId WriteProcessMemory GetFileSize SetFilePointer WriteFile Sleep SystemTimeToTzSpecificLocalTime GetTickCount GetTimeZoneInformation GetCurrentThread InitializeCriticalSection TerminateThread LeaveCriticalSection EnterCriticalSection OpenThread GetExitCodeThread DeleteCriticalSection SuspendThread ResumeThread AllocConsole ReadConsoleA FlushConsoleInputBuffer SetConsoleMode SetConsoleTitleA GetStdHandle SetConsoleCtrlHandler SetConsoleWindowInfo GetCurrentProcessId HeapAlloc HeapFree GetProcessHeap InterlockedIncrement VirtualProtect GetCPInfo GetACP GetOEMCP IsValidCodePage GetModuleHandleW ExitProcess DecodePointer GetCommandLineA HeapSetInformation GetStartupInfoW EncodePointer GetFullPathNameA HeapReAlloc ExitThread CreateThread RtlUnwind GetTimeFormatA GetDateFormatA GetSystemTimeAsFileTime DuplicateHandle MoveFileA CreateProcessA DeleteFileA SetStdHandle InitializeCriticalSectionAndSpinCount GetFileType TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError GetUserDefaultLCID GetLocaleInfoW GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetStringTypeW LCMapStringW LoadLibraryW GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount HeapCreate QueryPerformanceCounter RaiseException GetConsoleCP GetConsoleMode FlushFileBuffers GetDriveTypeW CompareStringW IsProcessorFeaturePresent CreatePipe GetExitCodeProcess HeapSize WriteConsoleW GetCurrentDirectoryW SetEndOfFile CreateFileW SetEnvironmentVariableA GetFileAttributesA LocalFree GetLastError MultiByteToWideChar WideCharToMultiByte FormatMessageA GetModuleFileNameA GetModuleHandleA IsBadReadPtr SetErrorMode

user32

CallWindowProcA WinHelpA EqualRect MapWindowPoints IsWindow RegisterClassA IsWindowVisible GetActiveWindow ShowWindow SetWindowPos LoadIconA CreateWindowExA DefWindowProcA GetSystemMenu SetActiveWindow IsIconic ModifyMenuA GetWindowThreadProcessId SendMessageA GetMessageA TranslateMessage PeekMessageA DispatchMessageA SetForegroundWindow SetWindowRgn GetWindowRect wsprintfA SetFocus OffsetRect IntersectRect MessageBoxA GetWindowLongA GetClientRect

ole32

OleRegGetUserType CreateOleAdviseHolder CoTaskMemAlloc OleCreate OleSetContainedObject StringFromIID CLSIDFromString CLSIDFromProgID CoRegisterClassObject CoRevokeClassObject MkParseDisplayName CreateBindCtx CoCreateInstance CoLockObjectExternal CoTaskMemFree OleInitialize OleUninitialize StringFromCLSID

shlwapi

SHDeleteKeyA StrFormatByteSize64A

gdi32

SetWindowOrgEx SetWindowExtEx DeleteObject CreateRectRgnIndirect SetViewportExtEx SetViewportOrgEx SetMapMode

advapi32

RegEnumKeyExA RegQueryValueExA IsTextUnicode AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken RegCloseKey RegCreateKeyExA RegOpenKeyExA RegSetValueExA

oleaut32

GetActiveObject VariantInit VariantCopyInd VariantClear LoadTypeLibEx SysFreeString SysStringLen SysAllocStringLen LoadRegTypeLi LHashValOfNameSys SafeArrayCreateVector VariantTimeToSystemTime SafeArrayAccessData VariantCopy SafeArrayDestroy SafeArrayCreate SystemTimeToVariantTime SafeArrayGetDim VariantChangeType SafeArrayGetElement SafeArrayUnaccessData SafeArrayPutElement DispGetIDsOfNames UnRegisterTypeLi