jaffacakes118_Trojan-Ransom[.]Win32[.]Timer[.]hbg[.]50186565afabd3e1e43ab25f1ebc315d

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan-Ransom.Win32.Timer.hbg.50186565afabd3e1e43ab25f1ebc315d
Size 44KB
Sample261006-vll4fady3p
SHA256 f355ad5ecf386a0f9c32471d40398a65cbbe729faa6f30e95be1098e6ed019e9
MD5 50186565afabd3e1e43ab25f1ebc315d
SHA1 725b4718e5b35c0e20476e637d402c1cf153bec3
SHA512 f7bd56ed5b71d5b4be5c637d1e3a79432d85a91cf4adc921df93570c0ddb1d4174779a30358012abbd422cbd6ad973abbc1d66be9f39ede70ed08c9d5352fafc
SSDEEP 768:ejRL3N8vU/C3UXwMnC+s2m/jg6Lff37J7jc6uUsW/vZJ5FxETHY:ERTN8v0b0d/jg0ffBrx1LETHY
TLSH
T1BF238D13EE0A52C6D4AF0B3410BA4B18E339E43D3F2A479F5169BA75FB503C36E56684
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan-Ransom.Win32.Timer.hbg.50186565afabd3e1e43ab25f1ebc315d

File Explorer

jaffacakes118_Trojan-Ransom.Win32.Timer.hbg.50186565afabd3e1e43ab25f1ebc315d

.exe 44KB

jaffacakes118_Trojan-Ransom.Win32.Timer.hbg.50186565afabd3e1e43ab25f1ebc315d

IMPHASH fb117157025a4fecab6736bc104d3ccd
SHA256 f355ad5ecf386a0f9c32471d40398a65cbbe729faa6f30e95be1098e6ed019e9
MD5 50186565afabd3e1e43ab25f1ebc315d
SHA1 725b4718e5b35c0e20476e637d402c1cf153bec3
SHA512 f7bd56ed5b71d5b4be5c637d1e3a79432d85a91cf4adc921df93570c0ddb1d4174779a30358012abbd422cbd6ad973abbc1d66be9f39ede70ed08c9d5352fafc
SSDEEP 768:ejRL3N8vU/C3UXwMnC+s2m/jg6Lff37J7jc6uUsW/vZJ5FxETHY:ERTN8v0b0d/jg0ffBrx1LETHY
TLSH
T1BF238D13EE0A52C6D4AF0B3410BA4B18E339E43D3F2A479F5169BA75FB503C36E56684
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4335

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

msdart

?sm_dblDfltSpinAdjFctr@CSpinLock@@1NA ?_Unlock@CSpinLock@@AAEXXZ ?Unlock@CLockedSingleList@@QAEXXZ ?WriteUnlock@CSmallSpinLock@@QAEXXZ ?InsertTail@CLockedDoubleList@@QAEXQAVCListEntry@@@Z ?_TryReadLock@CReaderWriterLock@@AAE_NXZ ?SetSpinCount@CFakeLock@@QAE_NG@Z ?_InsertThisIntoGlobalList@CLKRHashTable@@AAEXXZ ?_RemoveThisFromGlobalList@CLKRLinearHashTable@@AAEXXZ ?ConvertExclusiveToShared@CSpinLock@@QAEXXZ ?_CurrentThreadId@CSpinLock@@CGJXZ ?SetDefaultSpinCount@CReaderWriterLock3@@SGXG@Z ?sm_lpOSVERSIONINFO@CMdVersionInfo@@0PAU_OSVERSIONINFOW@@A ?IsWriteUnlocked@CLKRLinearHashTable@@QBE_NXZ MpHeapDestroy ?DeleteIf@CLKRHashTable@@QAEKP6G?AW4LK_PREDICATE@@PBXPAX@Z1@Z ?SetSpinCount@CSmallSpinLock@@QAE_NG@Z ?IsReadUnlocked@CReaderWriterLock@@QBE_NXZ ?GetDefaultSpinAdjustmentFactor@CCritSec@@SGNXZ ?RemoveHead@CLockedDoubleList@@QAEQAVCListEntry@@XZ ?ReadUnlock@CSpinLock@@QAEXXZ

kernel32

UnregisterConsoleIME HeapLock EnumResourceNamesA CopyFileExW GetSystemDefaultUILanguage VerLanguageNameA GetModuleHandleA QueueUserWorkItem GetDriveTypeA ReadConsoleInputExA GetWriteWatch FreeConsole ContinueDebugEvent DebugBreak TlsSetValue VirtualAlloc DeleteVolumeMountPointW CreateNamedPipeA SetCommState SetFileApisToANSI LoadLibraryA SetCommMask GetSystemDirectoryA FindFirstVolumeW LocalReAlloc

msvcrt

_wasctime _spawnvpe _ltoa rename _wtoi ___lc_handle_func ??_E__non_rtti_object@@UAEPAXI@Z fopen strncpy _mbsnbcpy _commode __getmainargs _get_osfhandle _endthread _ismbbpunct __STRINGTOLD __p__pctype ___lc_codepage_func malloc __set_app_type asctime _osplatform fputwc _heapused _snwscanf ispunct ??4bad_cast@@QAEAAV0@ABV0@@Z _winver signal __p__commode _i64tow

lz32

CopyLZFile GetExpandedNameA LZDone LZCreateFileW LZOpenFileA LZCopy LZOpenFileW LZStart LZInit GetExpandedNameW LZClose LZSeek LZCloseFile LZRead

hhsetup

?AddChildFolder@CFolder@@QAEPAV1@PBDKPAKG@Z ?AddChildFolder@CFolder@@QAEKPAV1@@Z ?HandleCollectionEntry@CCollection@@AAEKPAVCParseXML@@PAD@Z ?NewLocation@CCollection@@AAEPAVCLocation@@XZ ?Release@CCollection@@AAEKXZ ?GetParent@CFolder@@QAEPAV1@XZ ?SetTitle@CFolder@@QAEXPBG@Z ?AddTitle@CCollection@@QAEPAVCTitle@@PBD0000GIPAVCLocation@@PAKH0@Z ?SetExTitlePtr@CFolder@@QAEXPAVCExTitle@@@Z ?FindLocation@CCollection@@QAEPAVCLocation@@PBDPAI@Z ??4CFIFOString@@QAEAAV0@ABV0@@Z ?AddCollection@CCollection@@QAEPAVCColList@@XZ ?HandleFolder@CCollection@@AAEKPAVCParseXML@@PAD@Z ?GetId@CLocation@@QBEPADXZ ?GetSampleLocationW@CCollection@@QAEPBGXZ ?AddChildFolder@CFolder@@QAEPAV1@PBGKPAKG@Z ??1CFolder@@QAE@XZ ?SetId@CLocation@@QAEXPBG@Z ?SetParent@CFolder@@QAEXPAV1@@Z ?GetCollectionFileName@CCollection@@QAEPBDXZ ?IncrementRefTitleCount@CCollection@@QAEXXZ ?GetRootFolder@CCollection@@QAEPAVCFolder@@XZ ?RemoveCollection@CCollection@@QAEKH@Z ?SetTitle@CLocation@@QAEXPBG@Z ?DeleteTitle@CCollection@@AAEKPAVCTitle@@@Z ?SetLanguage@CTitle@@QAEXG@Z ?CheckTitleRef@CCollection@@AAEKPBDG@Z ?AllocCopyValue@CCollection@@AAEKPAVCParseXML@@PADPAPAD@Z

msvcp60

??0locale@std@@QAE@ABV01@@Z ??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAE@ABV01@@Z ?sputbackc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ??1locale@std@@QAE@XZ ??6std@@YAAAV?$basic_ostream@GU?$char_traits@G@std@@@0@AAV10@G@Z ??_7?$basic_istream@DU?$char_traits@D@std@@@std@@6B@ ??0runtime_error@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z ??_7?$basic_ifstream@DU?$char_traits@D@std@@@std@@6B@ ?clear@ios_base@std@@QAEXF@Z ?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXID@Z ??1ostrstream@std@@UAE@XZ ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ??0?$ctype@D@std@@QAE@PBF_NI@Z ??1runtime_error@std@@UAE@XZ ??_7?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@6B@ ??0messages_base@std@@QAE@I@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAPAX@Z ?_Getcat@?$numpunct@G@std@@SAIXZ ??0?$codecvt@GDH@std@@QAE@ABV_Locinfo@1@I@Z ??0_Locinfo@std@@QAE@PBD@Z ??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@C@Z ??1?$basic_ostream@GU?$char_traits@G@std@@@std@@UAE@XZ ?abs@std@@YANABV?$complex@N@1@@Z ??8std@@YA_NABV?$complex@N@0@0@Z ?replace@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IIPBGI@Z ?_Mode@?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEHH@Z ??0ios_base@std@@QAE@ABV01@@Z ??Hstd@@YA?AV?$complex@N@0@ABV10@ABN@Z ??Kstd@@YA?AV?$complex@M@0@ABV10@ABM@Z

ntdll

ZwQuerySemaphore RtlRestoreLastWin32Error NtRaiseException ZwUnloadDriver RtlFillMemory LdrUnloadAlternateResourceModule NtSetSystemPowerState NtCreateMailslotFile ZwDebugActiveProcess RtlIsGenericTableEmpty NtWaitForDebugEvent RtlSetThreadIsCritical CsrFreeCaptureBuffer ZwYieldExecution RtlSetUserFlagsHeap NtSetSystemEnvironmentValueEx RtlCopySid RtlGetLengthWithoutTrailingPathSeperators RtlFormatCurrentUserKeyPath _alldiv DbgUiWaitStateChange NtSetInformationProcess NtEnumerateKey ZwSuspendThread _CIlog NtCurrentTeb ZwSetEaFile NtMakeTemporaryObject