jaffacakes118_HEUR[.]Trojan[.]Win32[.]Generic[.]1be20004ce0a44627cc2efd0415a3b69

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.1be20004ce0a44627cc2efd0415a3b69
Size 571KB
Sample261008-mplcbafs2m
SHA256 e5eaa24723a6b64ce76149013fb97ffb15628bf6787be14cea1c9f84038f3654
MD5 1be20004ce0a44627cc2efd0415a3b69
SHA1 2b17199f1ac93aa0b85cd9b0fb1d13008ebb9567
SHA512 d586b85afe153c42fabc26c8903734ab049474b0ef9e91d2072bf235f531edff66cc497fe9066c2ed29b6f08aa73f22df27a06ed8bc29fb57953f6e2ae75d59d
SSDEEP 12288:0lqHWXdYUqpkIsD/zw7LJzWwmsgWYAYqFge09/brHE56hfzMK:7SOUqpuD/zw7LJzEsgWYsOFDrE56aK
TLSH
T1C8C42357CE634FC11908173F07BA408B9764FF47F2B0A31A64B6C87AB6856C44B647AE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
static1/unpack001/[HOT] Kata TOPLESS Amazing!.exe	autoit_exe

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/[HOT] Kata TOPLESS Amazing!.exe

File Explorer

jaffacakes118_HEUR.Trojan.Win32.Generic.1be20004ce0a44627cc2efd0415a3b69

.zip 571KB
[HOT] Kata TOPLESS Amazing!.exe

.exe 1.1MB

jaffacakes118_HEUR.Trojan.Win32.Generic.1be20004ce0a44627cc2efd0415a3b69

SHA256 e5eaa24723a6b64ce76149013fb97ffb15628bf6787be14cea1c9f84038f3654
MD5 1be20004ce0a44627cc2efd0415a3b69
SHA1 2b17199f1ac93aa0b85cd9b0fb1d13008ebb9567
SHA512 d586b85afe153c42fabc26c8903734ab049474b0ef9e91d2072bf235f531edff66cc497fe9066c2ed29b6f08aa73f22df27a06ed8bc29fb57953f6e2ae75d59d
SSDEEP 12288:0lqHWXdYUqpkIsD/zw7LJzWwmsgWYAYqFge09/brHE56hfzMK:7SOUqpuD/zw7LJzEsgWYsOFDrE56aK
TLSH
T1C8C42357CE634FC11908173F07BA408B9764FF47F2B0A31A64B6C87AB6856C44B647AE
MD5 SHA1 SHA512 SSDEEP TLSH

[HOT] Kata TOPLESS Amazing!.exe

IMPHASH 04b4eec1b14791bf23f31173f27a5df0
SHA256 159cef881ef94cf7c4ec55f737e550b493028ea173d6aa9502acec497bffa6a8
MD5 2dbb8febf83a7e4b8a5dc6f8d21adaa8
SHA1 df6be33e5c946804e0c6661bd2594fc8600f36cd
SHA512 6077c9a7e3904f1b988a02e25664adca0023a6b2435e3cf91b0f20576268508a3e72e8e0465ad4319ac44448363c29d436dafb6068c71378285e76c656aff19e
SSDEEP 24576:mRmJkqoQrilOIQ+yMxGaFQpMicU5DD0TlTdu:vJXoQryTiMxGaFdUFUxu
TLSH
T185354A52B2DB5221CD623574F927A671E3283D310F158967A2AC3E193FE029CD7B6F21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

AutoIT Executable

AutoIT scripts compiled to PE executables.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

91585

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

wsock32

__WSAFDIsSet setsockopt ntohs recvfrom sendto htons select listen WSAStartup bind closesocket connect socket send WSACleanup ioctlsocket accept WSAGetLastError inet_addr gethostbyname gethostname recv

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

winmm

timeGetTime waveOutSetVolume mciSendStringW

comctl32

ImageList_Remove ImageList_SetDragCursorImage ImageList_BeginDrag ImageList_DragEnter ImageList_DragLeave ImageList_EndDrag ImageList_DragMove ImageList_ReplaceIcon ImageList_Create InitCommonControlsEx ImageList_Destroy

mpr

WNetCancelConnection2W WNetGetConnectionW WNetAddConnection2W WNetUseConnectionW

wininet

InternetReadFile InternetCloseHandle InternetOpenW InternetSetOptionW InternetCrackUrlW HttpQueryInfoW InternetConnectW HttpOpenRequestW HttpSendRequestW FtpOpenFileW FtpGetFileSize InternetOpenUrlW InternetQueryOptionW InternetQueryDataAvailable

psapi

EnumProcesses GetModuleBaseNameW GetProcessMemoryInfo EnumProcessModules

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock UnloadUserProfile LoadUserProfileW

kernel32

HeapAlloc Sleep GetCurrentThreadId RaiseException MulDiv GetVersionExW GetSystemInfo InterlockedIncrement InterlockedDecrement WideCharToMultiByte lstrcpyW MultiByteToWideChar lstrlenW lstrcmpiW GetModuleHandleW QueryPerformanceCounter VirtualFreeEx OpenProcess VirtualAllocEx WriteProcessMemory ReadProcessMemory CreateFileW SetFilePointerEx ReadFile WriteFile FlushFileBuffers TerminateProcess CreateToolhelp32Snapshot Process32FirstW Process32NextW SetFileTime GetFileAttributesW FindFirstFileW FindClose DeleteFileW FindNextFileW MoveFileW CopyFileW CreateDirectoryW RemoveDirectoryW GetProcessHeap QueryPerformanceFrequency FindResourceW LoadResource LockResource SizeofResource EnumResourceNamesW OutputDebugStringW GetLocalTime CompareStringW DeleteCriticalSection EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount GetStdHandle CreatePipe InterlockedExchange TerminateThread GetTempPathW GetTempFileNameW VirtualFree FormatMessageW GetExitCodeProcess SetErrorMode GetPrivateProfileStringW WritePrivateProfileStringW GetPrivateProfileSectionW WritePrivateProfileSectionW GetPrivateProfileSectionNamesW FileTimeToLocalFileTime FileTimeToSystemTime SystemTimeToFileTime LocalFileTimeToFileTime GetDriveTypeW GetDiskFreeSpaceExW GetDiskFreeSpaceW GetVolumeInformationW SetVolumeLabelW CreateHardLinkW DeviceIoControl SetFileAttributesW GetShortPathNameW CreateEventW SetEvent GetEnvironmentVariableW SetEnvironmentVariableW GlobalLock GlobalUnlock GlobalAlloc GetFileSize GlobalFree GlobalMemoryStatusEx Beep GetSystemDirectoryW GetComputerNameW GetWindowsDirectoryW GetCurrentProcessId GetCurrentThread GetProcessIoCounters CreateProcessW SetPriorityClass LoadLibraryW VirtualAlloc LoadLibraryExW HeapFree WaitForSingleObject CreateThread DuplicateHandle GetLastError CloseHandle GetCurrentProcess GetProcAddress LoadLibraryA FreeLibrary GetModuleFileNameW GetFullPathNameW SetCurrentDirectoryW IsDebuggerPresent GetCurrentDirectoryW ExitProcess ExitThread GetSystemTimeAsFileTime ResumeThread GetTimeFormatW GetDateFormatW GetCommandLineW GetStartupInfoW IsProcessorFeaturePresent HeapSize GetCPInfo GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError UnhandledExceptionFilter SetUnhandledExceptionFilter GetStringTypeW HeapCreate SetHandleCount GetFileType SetStdHandle GetConsoleCP GetConsoleMode LCMapStringW RtlUnwind SetFilePointer GetTimeZoneInformation FreeEnvironmentStringsW GetEnvironmentStringsW GetTickCount HeapReAlloc WriteConsoleW SetEndOfFile SetSystemPowerState SetEnvironmentVariableA

user32

GetCursorInfo RegisterHotKey ClientToScreen GetKeyboardLayoutNameW IsCharAlphaW IsCharAlphaNumericW IsCharLowerW IsCharUpperW GetMenuStringW GetSubMenu GetCaretPos IsZoomed MonitorFromPoint GetMonitorInfoW SetWindowLongW SetLayeredWindowAttributes FlashWindow GetClassLongW TranslateAcceleratorW IsDialogMessageW GetSysColor InflateRect DrawFocusRect DrawTextW FrameRect DrawFrameControl FillRect PtInRect DestroyAcceleratorTable CreateAcceleratorTableW SetCursor GetWindowDC GetSystemMetrics GetActiveWindow CharNextW wsprintfW RedrawWindow DrawMenuBar DestroyMenu SetMenu GetWindowTextLengthW CreateMenu IsDlgButtonChecked DefDlgProcW ReleaseCapture SetCapture WindowFromPoint LoadImageW CreateIconFromResourceEx mouse_event ExitWindowsEx SetActiveWindow FindWindowExW EnumThreadWindows SetMenuDefaultItem InsertMenuItemW IsMenu TrackPopupMenuEx GetCursorPos DeleteMenu CheckMenuRadioItem SetWindowPos GetMenuItemCount SetMenuItemInfoW GetMenuItemInfoW SetForegroundWindow IsIconic FindWindowW SystemParametersInfoW TranslateMessage SendInput GetAsyncKeyState SetKeyboardState GetKeyboardState GetKeyState VkKeyScanW LoadStringW DialogBoxParamW MessageBeep EndDialog SendDlgItemMessageW GetDlgItem SetWindowTextW CopyRect ReleaseDC GetDC EndPaint BeginPaint GetClientRect GetMenu DestroyWindow EnumWindows GetDesktopWindow IsWindow IsWindowEnabled IsWindowVisible EnableWindow InvalidateRect GetWindowLongW AttachThreadInput GetFocus GetWindowTextW ScreenToClient SendMessageTimeoutW EnumChildWindows CharUpperBuffW GetClassNameW GetParent GetDlgCtrlID SendMessageW MapVirtualKeyW PostMessageW GetWindowRect SetUserObjectSecurity GetUserObjectSecurity CloseDesktop CloseWindowStation OpenDesktopW SetProcessWindowStation GetProcessWindowStation OpenWindowStationW MessageBoxW DefWindowProcW CopyImage AdjustWindowRectEx SetRect SetClipboardData EmptyClipboard CountClipboardFormats CloseClipboard GetClipboardData IsClipboardFormatAvailable OpenClipboard BlockInput GetMessageW LockWindowUpdate GetMenuItemID DispatchMessageW MoveWindow SetFocus PostQuitMessage KillTimer CreatePopupMenu RegisterWindowMessageW SetTimer ShowWindow CreateWindowExW RegisterClassExW LoadIconW LoadCursorW GetSysColorBrush GetForegroundWindow MessageBoxA DestroyIcon PeekMessageW UnregisterHotKey CharLowerBuffW keybd_event MonitorFromRect GetWindowThreadProcessId

gdi32

DeleteObject AngleArc GetTextExtentPoint32W ExtCreatePen StrokeAndFillPath StrokePath EndPath SetPixel CloseFigure CreateCompatibleBitmap CreateCompatibleDC SelectObject StretchBlt GetDIBits GetDeviceCaps MoveToEx DeleteDC GetPixel CreateDCW Ellipse PolyDraw BeginPath Rectangle SetViewportOrgEx GetObjectW SetBkMode RoundRect SetBkColor CreatePen CreateSolidBrush SetTextColor CreateFontW GetTextFaceW GetStockObject LineTo

comdlg32

GetSaveFileNameW GetOpenFileNameW

advapi32

RegEnumValueW RegDeleteValueW RegDeleteKeyW RegEnumKeyExW RegSetValueExW RegCreateKeyExW GetUserNameW RegConnectRegistryW CloseServiceHandle UnlockServiceDatabase OpenThreadToken OpenProcessToken LookupPrivilegeValueW DuplicateTokenEx CreateProcessAsUserW CreateProcessWithLogonW InitializeSecurityDescriptor InitializeAcl GetLengthSid CopySid LogonUserW LockServiceDatabase GetTokenInformation GetSecurityDescriptorDacl GetAclInformation GetAce AddAce SetSecurityDescriptorDacl RegOpenKeyExW RegQueryValueExW AdjustTokenPrivileges InitiateSystemShutdownExW OpenSCManagerW RegCloseKey

shell32

DragQueryPoint ShellExecuteExW SHGetFolderPathW DragQueryFileW SHEmptyRecycleBinW SHBrowseForFolderW SHFileOperationW SHGetPathFromIDListW SHGetDesktopFolder SHGetMalloc ExtractIconExW Shell_NotifyIconW ShellExecuteW DragFinish

ole32

OleSetMenuDescriptor MkParseDisplayName OleSetContainedObject CLSIDFromString StringFromGUID2 CoInitialize CoUninitialize CoCreateInstance CreateStreamOnHGlobal CoTaskMemAlloc CoTaskMemFree ProgIDFromCLSID OleInitialize CreateBindCtx CLSIDFromProgID CoInitializeSecurity CoCreateInstanceEx CoSetProxyBlanket OleUninitialize IIDFromString

oleaut32

VariantChangeType VariantCopyInd DispCallFunc CreateStdDispatch CreateDispTypeInfo SysFreeString SafeArrayDestroyDescriptor SafeArrayDestroyData SafeArrayUnaccessData SysStringLen SafeArrayAllocData GetActiveObject QueryPathOfRegTypeLi SafeArrayAllocDescriptorEx SafeArrayCreateVector SysAllocString VariantCopy VariantClear VariantTimeToSystemTime VarR8FromDec SafeArrayGetVartype OleLoadPicture SafeArrayAccessData VariantInit