jaffacakes118_Email-Worm[.]Win32[.]Klez[.]k[.]38164a9e06f9b79a0529debb716f8ed0

General

Target
jaffacakes118_Email-Worm.Win32.Klez.k.38164a9e06f9b79a0529debb716f8ed0
Size 77KB
Sample261009-tp4bfsbv5v
SHA256 218967eb882ccca95d8d01f90f2c3b3e8a184c3b9e64d1b0d314516404b1b17f
MD5 38164a9e06f9b79a0529debb716f8ed0
SHA1 8eeb511946fdc3979db043ca5626e4bd9ccc8837
SHA512 3add384821e60340c4d6f4f0a003ab281b8de8c559f611a3870ab0f98cdea3983c4c846cd77ab2f18db861045077ea6c00534232b59db8c32fdf73bb1249942d
SSDEEP 768:zXS6Lnze1gshn5ew/QuBdL/4Ckir4SWeq3HwFdkt+Afs2DBnotv0p//gK6KcgM/:TSSnze1gsJ55n/4CkOwwF+bhotwj8
TLSH
T109736C2379908473C8AA4D70116E4712CABEF4311B5AEAC3F719995B7F207D1EA3634B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Email-Worm.Win32.Klez.k.38164a9e06f9b79a0529debb716f8ed0

File Explorer

jaffacakes118_Email-Worm.Win32.Klez.k.38164a9e06f9b79a0529debb716f8ed0

.exe 77KB

jaffacakes118_Email-Worm.Win32.Klez.k.38164a9e06f9b79a0529debb716f8ed0

IMPHASH bb8a672644c54cc80e980f3e174cf92c
SHA256 218967eb882ccca95d8d01f90f2c3b3e8a184c3b9e64d1b0d314516404b1b17f
MD5 38164a9e06f9b79a0529debb716f8ed0
SHA1 8eeb511946fdc3979db043ca5626e4bd9ccc8837
SHA512 3add384821e60340c4d6f4f0a003ab281b8de8c559f611a3870ab0f98cdea3983c4c846cd77ab2f18db861045077ea6c00534232b59db8c32fdf73bb1249942d
SSDEEP 768:zXS6Lnze1gshn5ew/QuBdL/4Ckir4SWeq3HwFdkt+Afs2DBnotv0p//gK6KcgM/:TSSnze1gsJ55n/4CkOwwF+bhotwj8
TLSH
T109736C2379908473C8AA4D70116E4712CABEF4311B5AEAC3F719995B7F207D1EA3634B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

32888

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CopyFileA IsDBCSLeadByte WriteFile ReadFile GetTempFileNameA GetTempPathA DeleteFileA SetFileAttributesA FindClose FindNextFileA FindFirstFileA SetEndOfFile SetFilePointer GetComputerNameA SetFileTime GetTickCount CreateProcessA GetSystemDirectoryA GetCurrentProcess GetVersionExA GetVersion WaitForSingleObject GetCommandLineA ExpandEnvironmentStringsA GetDriveTypeA CreateThread MultiByteToWideChar WideCharToMultiByte GetCurrentProcessId LocalAlloc LocalFree GetLastError GetLocalTime UnmapViewOfFile FreeLibrary CreateFileA GetFileSize CreateFileMappingA MapViewOfFile Process32First Process32Next GetModuleFileNameA CreateToolhelp32Snapshot Module32First OpenProcess ReadProcessMemory TerminateProcess Sleep CloseHandle LoadLibraryA GetProcAddress GetFileTime SetStdHandle HeapReAlloc VirtualAlloc GetStringTypeW GetStringTypeA RtlUnwind VirtualFree HeapCreate HeapDestroy GetFileType GetStdHandle SetHandleCount GetEnvironmentStringsW GetEnvironmentStrings GetModuleHandleA GetStartupInfoA ExitProcess GetCPInfo GetACP GetOEMCP LCMapStringA LCMapStringW HeapFree HeapAlloc UnhandledExceptionFilter FreeEnvironmentStringsA FreeEnvironmentStringsW FlushFileBuffers

advapi32

StartServiceCtrlDispatcherA LookupPrivilegeValueA AdjustTokenPrivileges RegCreateKeyA RegSetValueExA RegQueryValueExA StartServiceA RegConnectRegistryA OpenProcessToken GetTokenInformation AllocateAndInitializeSid EqualSid FreeSid RegisterServiceCtrlHandlerA OpenServiceA SetServiceStatus OpenSCManagerA CreateServiceA CloseServiceHandle RegEnumValueA RegDeleteValueA RegOpenKeyA RegEnumKeyA RegCloseKey

ws2_32

gethostbyname closesocket WSACleanup send htons connect WSAGetLastError WSAStartup socket recv

mpr

WNetOpenEnumA WNetEnumResourceA WNetCloseEnum

Sharing