jaffacakes118_HEUR[.]Trojan[.]Win32[.]Generic[.]7601e01a2a965634d5c0274cc0358ad6

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.7601e01a2a965634d5c0274cc0358ad6
Size 41KB
Sample261009-vb9rrass7k
SHA256 832c34ff0057cd962f8839e27372148679f394acf52f98f21e2d180c4d953097
MD5 7601e01a2a965634d5c0274cc0358ad6
SHA1 d76d83385e02ed60653e7028bb41065336225d40
SHA512 394d2ae21d1aa85c9f784f2c3c3494c595fd9e2bc3663d8decaff503bbd495366bb6514a58e3c73f71a1e48e3d1e22aaf3a1186e1b00bfccbffa3a87f7a95d5c
SSDEEP 384:y2lbqr/fxQ0M9c9XNFtgHw36jYg2IIC3G974sD/77quBFdAAg+awpJKRkWXypTCv:/qbpQ0nPK6ID3Gj/7Hh2+hP6kWBJRoe
TLSH
T1A1137E527A1A4161D2E2863136652FB6CBFC68301E07A578EF32C7D71DB64CBDA32643
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_HEUR.Trojan.Win32.Generic.7601e01a2a965634d5c0274cc0358ad6

File Explorer

jaffacakes118_HEUR.Trojan.Win32.Generic.7601e01a2a965634d5c0274cc0358ad6

.dll 41KB

jaffacakes118_HEUR.Trojan.Win32.Generic.7601e01a2a965634d5c0274cc0358ad6

IMPHASH 0aebc7cffab119afb43c704883229fd7
SHA256 832c34ff0057cd962f8839e27372148679f394acf52f98f21e2d180c4d953097
MD5 7601e01a2a965634d5c0274cc0358ad6
SHA1 d76d83385e02ed60653e7028bb41065336225d40
SHA512 394d2ae21d1aa85c9f784f2c3c3494c595fd9e2bc3663d8decaff503bbd495366bb6514a58e3c73f71a1e48e3d1e22aaf3a1186e1b00bfccbffa3a87f7a95d5c
SSDEEP 384:y2lbqr/fxQ0M9c9XNFtgHw36jYg2IIC3G974sD/77quBFdAAg+awpJKRkWXypTCv:/qbpQ0nPK6ID3Gj/7Hh2+hP6kWBJRoe
TLSH
T1A1137E527A1A4161D2E2863136652FB6CBFC68301E07A578EF32C7D71DB64CBDA32643
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

26328

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

DeleteFileA CreateThread WaitForSingleObject ReadFile GetFileSize SetFilePointer GetLastError CreateEventA GetModuleFileNameA GetTempPathA GetWindowsDirectoryA GlobalLock CreateToolhelp32Snapshot TerminateProcess OpenProcess SetFileAttributesA GetCommandLineA CreateFileA WriteFile GlobalUnlock GlobalFree CloseHandle LoadLibraryA GetProcAddress GlobalAlloc VirtualProtect Sleep CreateProcessA ExitProcess MultiByteToWideChar WideCharToMultiByte GetPrivateProfileStringA GetSystemDirectoryA WritePrivateProfileStringA

user32

SetWindowLongA RegisterShellHookWindow RegisterWindowMessageA GetClassNameA GetClientRect CallWindowProcA GetDC GetWindowRect ReleaseDC GetWindowTextA GetParent GetWindowThreadProcessId wsprintfA EnumWindows GetDesktopWindow

gdi32

CreateDCA GetDeviceCaps DeleteObject BitBlt SelectObject CreateCompatibleBitmap CreateCompatibleDC GetDIBits RealizePalette SelectPalette GetStockObject GetObjectA DeleteDC

shell32

SHFileOperationA

gdiplus

GdiplusShutdown GdipLoadImageFromFile GdiplusStartup GdipGetImageEncoders GdipGetImageEncodersSize GdipFree GdipAlloc GdipCloneImage GdipSaveImageToFile GdipDisposeImage

msvcp60

??0_Lockit@std@@QAE@XZ ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB ?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ??0Init@ios_base@std@@QAE@XZ ??1Init@ios_base@std@@QAE@XZ ??0_Winit@std@@QAE@XZ ??1_Winit@std@@QAE@XZ ??1_Lockit@std@@QAE@XZ

ws2_32

connect htons closesocket socket recv gethostbyname inet_ntoa send WSAStartup inet_addr WSACleanup

wininet

InternetReadFile InternetOpenUrlA InternetOpenA InternetCloseHandle

msvcrt

strrchr _access strchr strncpy strstr abs malloc wcscmp memcpy free __dllonexit _onexit _initterm _adjust_fdiv _strlwr _getpid _stricmp _strrev __CxxFrameHandler sscanf strlen ??2@YAPAXI@Z atoi memset sprintf strcat strcpy strcmp

netapi32

Netbios