jaffacakes118_Trojan-PSW[.]Win32[.]Kykymber[.]dmsm[.]8ac99e4563e22b59c2ce125789af2bb1

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan-PSW.Win32.Kykymber.dmsm.8ac99e4563e22b59c2ce125789af2bb1
Size 39KB
Sample261006-veqs2sa17s
SHA256 8675bac8681e46fea0641632095c6499996f134085d1f6572469b353347dd14d
MD5 8ac99e4563e22b59c2ce125789af2bb1
SHA1 1df693cd275b0123519b127c17df3252ea68899c
SHA512 cd2ad7a0451300089fc045c1293ed630e06f3eae8d1c70052f14ed52b6e822e224695963493ef92e8cd2a26704a9b09a4a52a3c0efd497a52277a72ea27142b6
SSDEEP 768:Rp/yK+poPm9AmVvpApgvEv6qGZD/kzmNm18Q:jRMx9epLVGZD/kVd
TLSH
T131031ACB671508ABCED948B0735BFB2914BE6C31941890879773B1E82C3359BA675F0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan-PSW.Win32.Kykymber.dmsm.8ac99e4563e22b59c2ce125789af2bb1

File Explorer

jaffacakes118_Trojan-PSW.Win32.Kykymber.dmsm.8ac99e4563e22b59c2ce125789af2bb1

.dll 39KB

jaffacakes118_Trojan-PSW.Win32.Kykymber.dmsm.8ac99e4563e22b59c2ce125789af2bb1

IMPHASH f00ff314074609ab38dd1d137b25b103
SHA256 8675bac8681e46fea0641632095c6499996f134085d1f6572469b353347dd14d
MD5 8ac99e4563e22b59c2ce125789af2bb1
SHA1 1df693cd275b0123519b127c17df3252ea68899c
SHA512 cd2ad7a0451300089fc045c1293ed630e06f3eae8d1c70052f14ed52b6e822e224695963493ef92e8cd2a26704a9b09a4a52a3c0efd497a52277a72ea27142b6
SSDEEP 768:Rp/yK+poPm9AmVvpApgvEv6qGZD/kzmNm18Q:jRMx9epLVGZD/kVd
TLSH
T131031ACB671508ABCED948B0735BFB2914BE6C31941890879773B1E82C3359BA675F0B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

20094

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

OpenProcess GetCurrentProcessId IsBadReadPtr GetTempPathA CloseHandle GetFileAttributesW ReadProcessMemory VirtualQueryEx WideCharToMultiByte ReadFile GetFileSize CreateFileA SetFilePointer GetProcAddress OutputDebugStringA GetModuleHandleA TerminateProcess AddVectoredExceptionHandler InitializeCriticalSection LeaveCriticalSection EnterCriticalSection VirtualProtect FlushInstructionCache Thread32Next SetThreadContext GetThreadContext OpenThread Thread32First CreateToolhelp32Snapshot GetCurrentProcess CreateThread DeleteFileA FindFirstFileA FindNextFileA FindClose LoadLibraryA GetCommandLineA Sleep GetProcessHeap HeapAlloc GetModuleFileNameA

user32

wsprintfA GetDC GetWindowRect GetWindow GetClassNameW

wininet

InternetCloseHandle

msvcrt

strcpy memset malloc memcpy ??3@YAXPAX@Z ??2@YAPAXI@Z __CxxFrameHandler strncpy strlen strstr strchr strcat strrchr sprintf wcscmp ftell fseek fopen mbstowcs free srand time wcslen wcsncat wcscpy wcsstr exit printf _stricmp _except_handler3 _local_unwind2 strcmp _vsnprintf __dllonexit _onexit rand _strupr _strcmpi

gdiplus

GdipDisposeImage GdipGetImageEncodersSize GdipGetImageEncoders GdiplusStartup GdipCreateBitmapFromHBITMAP GdipSaveImageToFile

gdi32

CreateCompatibleDC GetDeviceCaps CreateDCA CreateCompatibleBitmap SelectObject BitBlt DeleteObject DeleteDC

msvcp60

??1_Lockit@std@@QAE@XZ ??0_Lockit@std@@QAE@XZ