jaffacakes118_Trojan-Spy[.]Win32[.]Ursnif[.]vgb[.]ad2a8d852e2b8c71e626a0ca29942390

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan-Spy.Win32.Ursnif.vgb.ad2a8d852e2b8c71e626a0ca29942390
Size 425KB
Sample261006-vqm7asff89
SHA256 40d36f01c937f8dfbab6f0a0391a3aa00979a7fb00bc54c2b0b629a12ccacd41
MD5 ad2a8d852e2b8c71e626a0ca29942390
SHA1 da8d8426e08022215bc55a4ed746e027c19c55b4
SHA512 458338da84a3bc2af7e11df1a0ffec4ef7ddee594787e33ba0ab1041693b3f152502d63473c71a1c361df111a01652922e4537b4c323de28c70efa3bd76f1521
SSDEEP 12288:+SGY0LCMzZGURXivEJkb/KR8CrQKWh+/ZAv:+SGYkRoWivEkPCrQKmG
TLSH
T19194DF12F6A0C131D5A671F4CC71ABF94B69AE60973485CF3BE23E9DAA302C24536357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan-Spy.Win32.Ursnif.vgb.ad2a8d852e2b8c71e626a0ca29942390

File Explorer

jaffacakes118_Trojan-Spy.Win32.Ursnif.vgb.ad2a8d852e2b8c71e626a0ca29942390

.exe 425KB

jaffacakes118_Trojan-Spy.Win32.Ursnif.vgb.ad2a8d852e2b8c71e626a0ca29942390

IMPHASH 35bb30b193262b2333f9819baa3bf42c
SHA256 40d36f01c937f8dfbab6f0a0391a3aa00979a7fb00bc54c2b0b629a12ccacd41
MD5 ad2a8d852e2b8c71e626a0ca29942390
SHA1 da8d8426e08022215bc55a4ed746e027c19c55b4
SHA512 458338da84a3bc2af7e11df1a0ffec4ef7ddee594787e33ba0ab1041693b3f152502d63473c71a1c361df111a01652922e4537b4c323de28c70efa3bd76f1521
SSDEEP 12288:+SGY0LCMzZGURXivEJkb/KR8CrQKWh+/ZAv:+SGYkRoWivEkPCrQKmG
TLSH
T19194DF12F6A0C131D5A671F4CC71ABF94B69AE60973485CF3BE23E9DAA302C24536357
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

279520

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

FlushFileBuffers WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle GetLocaleInfoA GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA InitializeCriticalSectionAndSpinCount HeapSize GetConsoleMode GetConsoleCP SetFilePointer GetSystemTimeAsFileTime GetTickCount QueryPerformanceCounter GetEnvironmentStringsW WideCharToMultiByte FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA WriteFile ExitProcess Sleep FindClose VirtualAlloc VirtualFree SetFileAttributesA GetOEMCP GetACP GetCPInfo DeleteCriticalSection GetFileType GetStdHandle SetHandleCount LeaveCriticalSection EnterCriticalSection InterlockedDecrement GetCurrentThreadId SetLastError InterlockedIncrement TlsFree TlsSetValue TlsAlloc GetFileSize GlobalAlloc GlobalLock GlobalUnlock GetModuleFileNameA HeapCreate GetProcAddress OpenProcess HeapAlloc GetCurrentProcessId LocalFree CreateDirectoryA FindFirstFileA lstrcpyA InterlockedExchange GetLastError TlsGetValue GetModuleHandleW HeapFree GetStartupInfoA GetCommandLineA MultiByteToWideChar RtlUnwind RaiseException IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess lstrcatA CopyFileA HeapReAlloc GetFileAttributesA CreateFileA DeviceIoControl CloseHandle ReadFile lstrcmpiA GetModuleFileNameW FormatMessageA lstrcpynA IsValidCodePage FindNextFileA GetModuleHandleA LoadLibraryA

user32

SendMessageA DdeCreateStringHandleA GetDC EnableWindow DefWindowProcA GetDlgItem IsWindowEnabled GetClientRect LoadStringA GetMenuItemID GetMenuItemCount SetClassLongW GetWindowPlacement GetWindowLongW SetWindowLongW SetScrollRange SetTimer CreateWindowExA MoveWindow GetSystemMetrics GetWindowRect GetRawInputDeviceList RegisterClassA LoadIconA DrawFrameControl GetIconInfo LoadImageW FillRect DrawIconEx DestroyIcon GetSysColor DdeDisconnectList DdeFreeDataHandle DdeGetData BeginPaint EndPaint DestroyWindow SetWindowRgn ReleaseDC ChangeClipboardChain LoadStringW MessageBoxA SetWindowTextA InsertMenuW CheckMenuItem SetWindowPos ClientToScreen IsWindow EndDialog SetClipboardViewer OpenClipboard IsClipboardFormatAvailable GetClipboardData FindWindowA GetMenu GetSubMenu GetMenuItemInfoA GetDialogBaseUnits

gdi32

Rectangle SetTextColor CreateSolidBrush GetObjectA CreateCompatibleDC CreateCompatibleBitmap DeleteDC CreatePen SetBkColor CreateDCA StartDocA BitBlt EnumFontFamiliesA DeleteObject SelectObject

advapi32

OpenProcessToken

shell32

ord155 SHBrowseForFolderA SHGetPathFromIDListA SHAddToRecentDocs

ole32

CoInitialize CoTaskMemFree CreateStreamOnHGlobal CoInitializeEx CoCreateInstance CLSIDFromString

oleaut32

OleLoadPicture OleSavePictureFile

ws2_32

closesocket

psapi

GetModuleFileNameExA EnumProcessModules GetModuleBaseNameA

msvfw32

DrawDibDraw DrawDibOpen ord2 MCIWndCreateA

winmm

waveOutGetNumDevs waveInGetNumDevs waveOutGetDevCapsA auxGetNumDevs mmioDescend mmioClose waveOutOpen midiInGetNumDevs mmioOpenA

crypt32

CryptMsgCalculateEncodedLength CryptMsgClose

cryptui

CryptUIWizImport

shlwapi

PathFindFileNameA StrChrA StrCmpIW SHStrDupW PathFindExtensionA

comctl32

ImageList_DragShowNolock ImageList_DragEnter ImageList_Destroy ImageList_BeginDrag ImageList_ReplaceIcon ImageList_Create ord17

imm32

ImmGetContext ImmReleaseContext ImmGetCompositionStringA

uxtheme

GetThemeBackgroundRegion

urlmon

CoInternetParseUrl

dxva2

SetVCPFeature