jaffacakes118_Trojan-Dropper[.]Win32[.]Agent[.]nl[.]56cde2871d90ef52f3719449e1213f58

General

Target
jaffacakes118_Trojan-Dropper.Win32.Agent.nl.56cde2871d90ef52f3719449e1213f58
Size 478KB
Sample261006-tjs9asfe45
SHA256 a650c0d6a8f6206fb90420e510e1e3508f0587deec2e7ca977b5a3d108349483
MD5 56cde2871d90ef52f3719449e1213f58
SHA1 4bce88ab13e52bf6ee38f10ae61fdcd4a8a1448f
SHA512 23128b4f612d93b73ee26a1f3b1d19539eecca8f7e7005cd36cf006e986a341fb7f8d0dff887931c3d350dbb7b2f10ddc39eec1a7925504e1408e9559ad883fb
SSDEEP 12288:rdnCFi1ppT+Q3zS9Py7hQlALj0wuy9CowcikdY8:0mX3zSxlAnruy8vkdY8
TLSH
T136A41243B694C071C0DA453086974F715FB6EE346F248E378F92BB9E2E70194D91EA2E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Detected Nirsoft tools 1 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
sample	Nirsoft

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan-Dropper.Win32.Agent.nl.56cde2871d90ef52f3719449e1213f58

jaffacakes118_Trojan-Dropper.Win32.Agent.nl.56cde2871d90ef52f3719449e1213f58

.exe 478KB

SHA256 a650c0d6a8f6206fb90420e510e1e3508f0587deec2e7ca977b5a3d108349483
MD5 56cde2871d90ef52f3719449e1213f58
SHA1 4bce88ab13e52bf6ee38f10ae61fdcd4a8a1448f
SHA512 23128b4f612d93b73ee26a1f3b1d19539eecca8f7e7005cd36cf006e986a341fb7f8d0dff887931c3d350dbb7b2f10ddc39eec1a7925504e1408e9559ad883fb
SSDEEP 12288:rdnCFi1ppT+Q3zS9Py7hQlALj0wuy9CowcikdY8:0mX3zSxlAnruy8vkdY8
TLSH
T136A41243B694C071C0DA453086974F715FB6EE346F248E378F92BB9E2E70194D91EA2E
MD5 SHA1 SHA512 SSDEEP TLSH

Detected Nirsoft tools

Free utilities often used by attackers which can steal passwords, product keys, etc.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

603218

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths