jaffacakes118_HEUR[.]Trojan[.]Win32[.]Generic[.]8ccb1091e1c765e7e8a16a643dbe5455

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.8ccb1091e1c765e7e8a16a643dbe5455
Size 270KB
Sample261009-vdd3vs1taz
SHA256 019e00198af1c6c4d7e34bc158386b7d309a5bd317b198725261c3d49990857d
MD5 8ccb1091e1c765e7e8a16a643dbe5455
SHA1 bb607cbe97ac9a07430282ca565cd54b5d4ede4c
SHA512 a6707d24a55826c688d44dee4edc8501b3e790194d57953b86bd591637968b20391c5d4db2110000e8657a7f04d3c7811692f3e83c36672b9a7ce7ba9febca22
SSDEEP 6144:zxgW3S0nqUQFqyU+hp1CTJRxoB53JYRf/0ml:mWC0nqUNc1CRor3JEj
TLSH
T132449ABF6D95021ED81172F374D1EBAD8268A8D907E07F4FE10470FDAC22A1F5A1A45B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_HEUR.Trojan.Win32.Generic.8ccb1091e1c765e7e8a16a643dbe5455

File Explorer

jaffacakes118_HEUR.Trojan.Win32.Generic.8ccb1091e1c765e7e8a16a643dbe5455

.exe 270KB

jaffacakes118_HEUR.Trojan.Win32.Generic.8ccb1091e1c765e7e8a16a643dbe5455

IMPHASH 83f7b8c36e9856e9022710657c86e389
SHA256 019e00198af1c6c4d7e34bc158386b7d309a5bd317b198725261c3d49990857d
MD5 8ccb1091e1c765e7e8a16a643dbe5455
SHA1 bb607cbe97ac9a07430282ca565cd54b5d4ede4c
SHA512 a6707d24a55826c688d44dee4edc8501b3e790194d57953b86bd591637968b20391c5d4db2110000e8657a7f04d3c7811692f3e83c36672b9a7ce7ba9febca22
SSDEEP 6144:zxgW3S0nqUQFqyU+hp1CTJRxoB53JYRf/0ml:mWC0nqUNc1CRor3JEj
TLSH
T132449ABF6D95021ED81172F374D1EBAD8268A8D907E07F4FE10470FDAC22A1F5A1A45B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

54729

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetUnhandledExceptionFilter CreateEventW SignalObjectAndWait FormatMessageW CopyFileW IsDebuggerPresent WideCharToMultiByte RaiseException GetThreadLocale GetProcessHeap CloseHandle lstrlenW CreateThread HeapAlloc GetACP HeapReAlloc WaitForSingleObject EnterCriticalSection UnhandledExceptionFilter SizeofResource LoadResource CreateFileW FindResourceExW FindResourceW DeleteCriticalSection LockResource LeaveCriticalSection CreateDirectoryW HeapFree HeapDestroy GetCurrentThreadId SetThreadLocale GetSystemTimeAsFileTime lstrlenA LocalFree HeapSize GetFullPathNameW VirtualAlloc

user32

UnregisterClassA

shell32

SHGetFolderPathW

shlwapi

PathAppendW

oleaut32

SafeArrayCopy GetErrorInfo SafeArrayDestroy SafeArrayGetVartype LoadTypeLi VariantInit SafeArrayCreate VarBstrCmp VariantCopyInd VariantChangeType LoadRegTypeLi VariantCopy SafeArrayUnlock SafeArrayGetUBound VariantClear SysFreeString SysStringByteLen SafeArrayLock SysAllocStringLen SysStringLen SafeArrayRedim SysAllocString SysAllocStringByteLen SafeArrayGetLBound

userenv

UnloadUserProfile

ole32

CoInitializeEx CoCreateInstance CLSIDFromProgID CoImpersonateClient CLSIDFromString OleRun CoUninitialize CoRevertToSelf

advapi32

InitializeSid RegCloseKey DeregisterEventSource OpenThreadToken RegEnumKeyExW GetLengthSid CopySid RegOpenKeyExW GetSidLengthRequired RegEnumValueW ConvertStringSidToSidW EqualSid RegQueryValueExW OpenProcessToken GetSidSubAuthority RegisterEventSourceW IsValidSid GetTokenInformation ReportEventW

atl

AtlModuleInit AtlAxGetControl AtlModuleUnregisterServer AtlModuleExtractCreateWndData AtlModuleRegisterWndClassInfoW AtlModuleRegisterServer AtlPixelToHiMetric

kbdca

KbdLayerDescriptor

Name

.QzGAW

Size

1024B

Virtual Size

33KB

Characteristics

IMAGE_SCN_MEM_READ

Name

.text

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.ItMWXy

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.NDhHb

Size

1024B

Virtual Size

521B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rEIYpu

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rDEgjB

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

7KB

Virtual Size

221KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

208KB

Virtual Size

207KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.MOTRc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.QqIfMj

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.XEDnIxa

Size

1024B

Virtual Size

926B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.lznL

Size

512B

Virtual Size

479B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.Fjkkx

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_HEUR.Trojan.Win32.Generic.8ccb1091e1c765e7e8a16a643dbe5455

kernel32

user32

shell32

shlwapi

oleaut32

userenv

ole32

advapi32

atl

kbdca

generic