jaffacakes118_HEUR[.]Trojan[.]Win32[.]Generic[.]7e4066079695d85752a8cb696e7fc064

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.7e4066079695d85752a8cb696e7fc064
Size 236KB
Sample261009-vclfjsb121
SHA256 1402149f18125b8cdc25614808ed447683992446d7281a781a6968c133857f75
MD5 7e4066079695d85752a8cb696e7fc064
SHA1 972b6704721c740b755e77197181cb36dbb081e8
SHA512 2ad26b63f7eaf134a5774b42c995686f40f60ddd368ee1054894b0ad10f43b0ab79814cf4f34c955ff02afd0511a886d4ea4a3e9979d2363e6b6ddd593382fc3
SSDEEP 3072:SeqmgHwlaazN9U3J+P0wFp+bLrt2wkkIg:+Qj9U3jwO3rt57
TLSH
T15434C0107AB8C038F61485B41D792F33D97FAE040B5BA1B7A7E49959DCF1570AE0A32B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_HEUR.Trojan.Win32.Generic.7e4066079695d85752a8cb696e7fc064

File Explorer

jaffacakes118_HEUR.Trojan.Win32.Generic.7e4066079695d85752a8cb696e7fc064

.dll 236KB

jaffacakes118_HEUR.Trojan.Win32.Generic.7e4066079695d85752a8cb696e7fc064

IMPHASH 5849ec7e33edc79e21a2eb4e0aae60f0
SHA256 1402149f18125b8cdc25614808ed447683992446d7281a781a6968c133857f75
MD5 7e4066079695d85752a8cb696e7fc064
SHA1 972b6704721c740b755e77197181cb36dbb081e8
SHA512 2ad26b63f7eaf134a5774b42c995686f40f60ddd368ee1054894b0ad10f43b0ab79814cf4f34c955ff02afd0511a886d4ea4a3e9979d2363e6b6ddd593382fc3
SSDEEP 3072:SeqmgHwlaazN9U3J+P0wFp+bLrt2wkkIg:+Qj9U3jwO3rt57
TLSH
T15434C0107AB8C038F61485B41D792F33D97FAE040B5BA1B7A7E49959DCF1570AE0A32B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4324

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

advapi32

AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken

kernel32

CloseHandle CreateFileA CreateThread CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileA EnterCriticalSection ExitProcess FreeEnvironmentStringsA GetACP GetCPInfo GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentStrings GetFileAttributesA GetFileSize GetFileType GetLastError GetLocalTime GetModuleFileNameA GetModuleHandleA GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoA GetStdHandle GetStringTypeW GetSystemDirectoryA GetTempPathA GetTickCount GetTimeZoneInformation GetVersion GetVersionExA GlobalMemoryStatus HeapAlloc HeapFree InitializeCriticalSection LCMapStringA LCMapStringW LeaveCriticalSection LoadLibraryA MultiByteToWideChar OpenProcess Process32First Process32Next RaiseException ReadFile RtlUnwind SetConsoleCtrlHandler SetFilePointer SetHandleCount SetLastError TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter VirtualAlloc VirtualFree VirtualQuery WaitForSingleObject WideCharToMultiByte WriteFile lstrlenA

version

GetFileVersionInfoA GetFileVersionInfoSizeA

wsock32

closesocket gethostbyname htons setsockopt

user32

CharLowerA EnumThreadWindows MessageBoxA wsprintfA

Name

.text

Size

73KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

153KB

Virtual Size

172KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.edata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_HEUR.Trojan.Win32.Generic.7e4066079695d85752a8cb696e7fc064

advapi32

kernel32

version

wsock32

user32

generic