jaffacakes118_Trojan-Dropper[.]Win32[.]Agent[.]ny[.]3cdb3c386baa7a7b70f4a610147f3a8d

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan-Dropper.Win32.Agent.ny.3cdb3c386baa7a7b70f4a610147f3a8d
Size 620KB
Sample261006-tkb2ea1yds
SHA256 58b2c7a2a0edfc13b2767220d8a501e2efe53ae73ba8576b939d71cd9990ca55
MD5 3cdb3c386baa7a7b70f4a610147f3a8d
SHA1 191328290e97dff76c2498dce1ddc3b5c9745eb0
SHA512 4c191c09f14fb73fbf0d3c47f6806d9593ecd9ae5152f6c6d468a9cea4db588abdf084f89685dcab2e36f6b9da376324f08d85d8b1ebae5bae92e6252e3765a8
SSDEEP 12288:FVqtCmv1gQVGw0qpw50F8wNNrZGkLcDSXPgejrP+:f6R1gQVG/uF845ZGkLcDSXPgez+
TLSH
T196D4125FBA242B2FC47142304EB3A5B1A3767C3467C94682386CF95D317272D17AABC9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan-Dropper.Win32.Agent.ny.3cdb3c386baa7a7b70f4a610147f3a8d

File Explorer

jaffacakes118_Trojan-Dropper.Win32.Agent.ny.3cdb3c386baa7a7b70f4a610147f3a8d

.exe 620KB

jaffacakes118_Trojan-Dropper.Win32.Agent.ny.3cdb3c386baa7a7b70f4a610147f3a8d

IMPHASH aaa734bdf233e7b6248c47353f08a15f
SHA256 58b2c7a2a0edfc13b2767220d8a501e2efe53ae73ba8576b939d71cd9990ca55
MD5 3cdb3c386baa7a7b70f4a610147f3a8d
SHA1 191328290e97dff76c2498dce1ddc3b5c9745eb0
SHA512 4c191c09f14fb73fbf0d3c47f6806d9593ecd9ae5152f6c6d468a9cea4db588abdf084f89685dcab2e36f6b9da376324f08d85d8b1ebae5bae92e6252e3765a8
SSDEEP 12288:FVqtCmv1gQVGw0qpw50F8wNNrZGkLcDSXPgejrP+:f6R1gQVG/uF845ZGkLcDSXPgez+
TLSH
T196D4125FBA242B2FC47142304EB3A5B1A3767C3467C94682386CF95D317272D17AABC9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

311296

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GlobalUnlock GlobalLock GlobalAlloc GetTickCount WideCharToMultiByte IsBadReadPtr GlobalAddAtomA GlobalAddAtomW GetModuleHandleA GlobalFree GlobalGetAtomNameA GlobalDeleteAtom GlobalGetAtomNameW FreeConsole GetEnvironmentVariableA VirtualProtect VirtualAlloc GetProcAddress GetLastError LoadLibraryA SetLastError SetThreadPriority GetCurrentThread CreateProcessA GetCommandLineA GetStartupInfoA SetEnvironmentVariableA ReleaseMutex WaitForSingleObject CreateMutexA OpenMutexA GetCurrentThreadId CloseHandle ReadFile GetFileSize CreateFileA FindClose FindFirstFileA FindFirstFileW VirtualQueryEx GetExitCodeProcess ReadProcessMemory ContinueDebugEvent SetThreadContext GetThreadContext WaitForDebugEvent SuspendThread CreateThread ResumeThread CreateProcessW GetCommandLineW GetStartupInfoW MapViewOfFile DuplicateHandle GetCurrentProcess CreateFileMappingA VirtualProtectEx WriteProcessMemory ExitProcess CompareStringA FlushFileBuffers LCMapStringW LCMapStringA SetStdHandle GetOEMCP GetACP GetCPInfo GetStringTypeW GetStringTypeA CompareStringW MultiByteToWideChar SetFilePointer HeapReAlloc WriteFile VirtualFree HeapCreate HeapDestroy GetFileType GetStdHandle SetHandleCount GetEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsW FreeEnvironmentStringsA UnhandledExceptionFilter HeapFree HeapAlloc GetVersion GetLocalTime GetSystemTime GetTimeZoneInformation RtlUnwind TerminateProcess Sleep EnterCriticalSection LeaveCriticalSection GetVersionExA InitializeCriticalSection GetCurrentProcessId GetModuleFileNameW GetShortPathNameW GetModuleFileNameA DebugActiveProcess GetShortPathNameA

user32

GetDesktopWindow MoveWindow SetPropA EnumThreadWindows GetPropA GetMessageA BeginPaint EndPaint KillTimer GetAsyncKeyState GetSystemMetrics SetTimer SetWindowTextA GetDlgItem CreateDialogIndirectParamA ShowWindow UpdateWindow LoadStringA LoadStringW FindWindowA WaitForInputIdle DestroyWindow MessageBoxA InSendMessage UnpackDDElParam FreeDDElParam DefWindowProcA LoadCursorA RegisterClassW CreateWindowExW RegisterClassA CreateWindowExA GetWindowThreadProcessId SendMessageA PeekMessageA TranslateMessage DispatchMessageA EnumWindows IsWindowUnicode PackDDElParam PostMessageW PostMessageA IsWindow SendMessageW

gdi32

DeleteDC RealizePalette SelectPalette CreateDCA CreatePalette DeleteObject BitBlt SelectObject CreateCompatibleDC CreateDIBitmap

Name

.text

Size

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text1

Size

196KB

Virtual Size

256KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.adata

Size

52KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data1

Size

40KB

Virtual Size

128KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

176KB

Virtual Size

192KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

152KB

Virtual Size

152KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_Trojan-Dropper.Win32.Agent.ny.3cdb3c386baa7a7b70f4a610147f3a8d

kernel32

user32

gdi32

generic