jaffacakes118_Trojan-Ransom[.]Win32[.]Timer[.]clr[.]95007ea8bfb22db3fd4d9f5d7eb95037

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan-Ransom.Win32.Timer.clr.95007ea8bfb22db3fd4d9f5d7eb95037
Size 60KB
Sample261006-vlfxesdy3j
SHA256 00bef726b2f9f053160205e34c6630b91574b80d084c039c1f629f006b1edbc7
MD5 95007ea8bfb22db3fd4d9f5d7eb95037
SHA1 a080ebb7a4979b99d7886e97e3b697c5a8569f12
SHA512 dacc1972a28f4b35cc4e2e8661ff6e5c8daeaaad75bed08091f77f67b15c9794aee90d8f18bdb37edacd3845f1861493bdd9f6b4160d1c6ee2121a340b0fbb4f
SSDEEP 1536:/Yyb9J03Bj+9RRe/xGwOT52X/6w/F/YsgCO0Mzmlf7MKFn:/Ym959KxG1wPnez7KFn
TLSH
T15A531953EA4842C2D86F1B7015F95B0DE23196397B5F438B11ADF938FED13C26A22789
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan-Ransom.Win32.Timer.clr.95007ea8bfb22db3fd4d9f5d7eb95037

File Explorer

jaffacakes118_Trojan-Ransom.Win32.Timer.clr.95007ea8bfb22db3fd4d9f5d7eb95037

.exe 60KB

jaffacakes118_Trojan-Ransom.Win32.Timer.clr.95007ea8bfb22db3fd4d9f5d7eb95037

IMPHASH 0496607cb0064e1cd428d2220b85f8cc
SHA256 00bef726b2f9f053160205e34c6630b91574b80d084c039c1f629f006b1edbc7
MD5 95007ea8bfb22db3fd4d9f5d7eb95037
SHA1 a080ebb7a4979b99d7886e97e3b697c5a8569f12
SHA512 dacc1972a28f4b35cc4e2e8661ff6e5c8daeaaad75bed08091f77f67b15c9794aee90d8f18bdb37edacd3845f1861493bdd9f6b4160d1c6ee2121a340b0fbb4f
SSDEEP 1536:/Yyb9J03Bj+9RRe/xGwOT52X/6w/F/YsgCO0Mzmlf7MKFn:/Ym959KxG1wPnez7KFn
TLSH
T15A531953EA4842C2D86F1B7015F95B0DE23196397B5F438B11ADF938FED13C26A22789
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

12456

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ntdll

NtPrivilegeCheck RtlTraceDatabaseEnumerate ZwPrivilegeCheck RtlMakeSelfRelativeSD ZwSetDefaultUILanguage RtlCreateProcessParameters RtlUpcaseUnicodeString NtSetIoCompletion RtlPrefixUnicodeString ZwFlushWriteBuffer RtlAddAccessAllowedAceEx ZwQueryPerformanceCounter ZwOpenSection RtlFreeAnsiString ZwQueryInformationFile DbgUiSetThreadDebugObject RtlUnicodeStringToAnsiString ZwFreeVirtualMemory ZwLockProductActivationKeys RtlGetNtProductType RtlTraceDatabaseCreate LdrFindResource_U

tcpmonui

??1CTcpMibABC@@UAE@XZ ??_7CTcpMibABC@@6B@ ??4CPortABC@@QAEAAV0@ABV0@@Z ?Read@CPortABC@@UAEKQAXPAEKPAK@Z LocalConfigurePortUI ??_7CPortABC@@6B@ LocalAddPortUI ??0CPortABC@@QAE@ABV0@@Z InitializePrintMonitorUI ??0CTcpMibABC@@QAE@ABV0@@Z ??0CPortABC@@QAE@XZ ??4CTcpMibABC@@QAEAAV0@ABV0@@Z ??0CTcpMibABC@@QAE@XZ ??1CPortABC@@UAE@XZ

msvcp60

?clear@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXF@Z ??1?$basic_ifstream@GU?$char_traits@G@std@@@std@@UAE@XZ ??_7?$basic_ifstream@GU?$char_traits@G@std@@@std@@6B@ ??0?$collate@G@std@@QAE@ABV_Locinfo@1@I@Z ?pbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXH@Z ?_Gndec@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEPAGXZ ??_8?$basic_ofstream@GU?$char_traits@G@std@@@std@@7B@ ?rfind@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIABV12@I@Z ??4?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@ABV01@@Z wctob mbrtowc ?close@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ ?find_last_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z ??0?$basic_stringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@H@Z ??4?$allocator@X@std@@QAEAAV01@ABV01@@Z ?signaling_NaN@?$numeric_limits@N@std@@SANXZ ??_F?$basic_stringbuf@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXXZ ??0?$complex@M@std@@QAE@ABV?$complex@O@1@@Z ??_D?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ ??_7?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@6B@ _Snan ??Hstd@@YA?AV?$complex@N@0@ABNABV10@@Z ?quiet_NaN@?$numeric_limits@M@std@@SAMXZ

activeds

ADsFreeEnumerator ADsGetObject ADsEncodeBinaryData ConvertSecDescriptorToVariant ADsOpenObject PropVariantToAdsType BinarySDToSecurityDescriptor ADsEnumerateNext ReallocADsMem ADsBuildVarArrayInt DllCanUnloadNow AdsTypeToPropVariant AdsTypeToPropVariant2 ADsBuildVarArrayStr FreeADsMem ADsDecodeBinaryData ConvertSecurityDescriptorToSecDes DllGetClassObject AllocADsMem AllocADsStr ReallocADsStr ADsBuildEnumerator FreeADsStr SecurityDescriptorToBinarySD ADsSetLastError ADsGetLastError PropVariantToAdsType2 AdsFreeAdsValues

oleaut32

VarI1FromI2 OleLoadPicturePath VariantCopyInd VarBoolFromI1 VarI1FromUI8 VarDateFromR4 VarDateFromStr VarI8FromDec VarFormatPercent SetErrorInfo VarCyFromDate VarR4FromDisp VarOr VarUI1FromDisp LPSAFEARRAY_Size VarUI1FromR4 VarI1FromDate RegisterTypeLib DispInvoke SafeArrayPtrOfIndex VarFormatFromTokens VarBstrFromDisp VarR4FromI4 VarI1FromDec

ole32

OleCreateFromData CreateStdProgressIndicator WriteOleStg ReadStringStream CoCancelCall WriteClassStg OleMetafilePictFromIconAndLabel CLIPFORMAT_UserSize ComPs_NdrDllCanUnloadNow CoTaskMemAlloc CoGetCancelObject CoReactivateObject HMENU_UserFree OleDuplicateData CoSetCancelObject OleSave StgConvertVariantToProperty OleCreateDefaultHandler DllGetClassObject ReadClassStg CoFreeLibrary CoQueryAuthenticationServices HENHMETAFILE_UserFree HMETAFILEPICT_UserSize

mapi32

UNKOBJ_FreeRows@8 LpValFindProp@12 MAPISendMail RTFSync@12 HrThisThreadAdviseSink@8 CreateTable@36 MAPIUninitialize@0 FBadSortOrderSet@4 MNLS_lstrcmpW@8 MAPIDeinitIdle@0 BMAPIFindNext SzFindSz@8 MAPIOpenFormMgr@8 MAPIAllocateBuffer@8 MAPIFreeBuffer LAUNCHWIZARD EncodeID@12 WrapCompressedRTFStream PRProviderInit MAPILogonEx HrGetOneProp@12 FBadPropTag@4

kernel32

QueryPerformanceCounter SetLocalPrimaryComputerNameA RemoveVectoredExceptionHandler GetPrivateProfileIntA GetSystemTimeAsFileTime FindCloseChangeNotification RegisterWaitForSingleObject LoadLibraryW EnumResourceNamesA CreateIoCompletionPort SetConsoleActiveScreenBuffer SetLocalTime WaitForMultipleObjectsEx FindFirstFileA CompareStringW SetUserGeoID GetCurrentProcessId GetNamedPipeHandleStateW LoadLibraryA GetProfileSectionW GetModuleHandleW GetStartupInfoW MoveFileWithProgressA SetMessageWaitingIndicator CreateMailslotA VirtualAlloc GetProcAddress AddConsoleAliasW OpenWaitableTimerW GetTickCount GlobalLock GetCurrentThreadId MulDiv InterlockedExchangeAdd IsValidLanguageGroup