jaffacakes118_HEUR[.]Trojan[.]Win32[.]Generic[.]9c9a15444b104fb6d743f258110c313e

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.9c9a15444b104fb6d743f258110c313e
Size 54KB
Sample261009-ver14scg53
SHA256 868a295b345bfb0e7ce00664bf4a5cc3a95f5d65ad995bcfbfb5db6803fcb5fe
MD5 9c9a15444b104fb6d743f258110c313e
SHA1 004689fc9d15c6d77878c7af58e2e4081700dccf
SHA512 3d1504899da0132d3bfb0c8def875d8a406835931bf52a4291db46525ead36bb5af35ba3e38cf7c11ed0aeec934055c9449e41325c5efc65a3efe92a8a80cc2c
SSDEEP 1536:vosQQ4PJEDOoMTRvoEAsK1TYHXQ5kKHaDUjhGH6d:vosahEIFoELHXO0+
TLSH
T16B43F1C7A2381DF1D5900A74B89BA52677FBF25A84F10F034ECE2F8F9D2C5B2855A254
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_HEUR.Trojan.Win32.Generic.9c9a15444b104fb6d743f258110c313e

File Explorer

jaffacakes118_HEUR.Trojan.Win32.Generic.9c9a15444b104fb6d743f258110c313e

.dll 54KB

jaffacakes118_HEUR.Trojan.Win32.Generic.9c9a15444b104fb6d743f258110c313e

IMPHASH adabc2f96f8d90ec1172f46e961b94c3
SHA256 868a295b345bfb0e7ce00664bf4a5cc3a95f5d65ad995bcfbfb5db6803fcb5fe
MD5 9c9a15444b104fb6d743f258110c313e
SHA1 004689fc9d15c6d77878c7af58e2e4081700dccf
SHA512 3d1504899da0132d3bfb0c8def875d8a406835931bf52a4291db46525ead36bb5af35ba3e38cf7c11ed0aeec934055c9449e41325c5efc65a3efe92a8a80cc2c
SSDEEP 1536:vosQQ4PJEDOoMTRvoEAsK1TYHXQ5kKHaDUjhGH6d:vosahEIFoELHXO0+
TLSH
T16B43F1C7A2381DF1D5900A74B89BA52677FBF25A84F10F034ECE2F8F9D2C5B2855A254
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

40781

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ws2_32

connect htons WSACleanup select WSAGetLastError shutdown __WSAFDIsSet inet_addr sendto WSAStartup ioctlsocket recv gethostbyname send socket closesocket

psapi

GetModuleBaseNameA EnumProcessModules EnumProcesses

crypt32

CryptBinaryToStringA CryptStringToBinaryA

urlmon

ObtainUserAgentString

kernel32

IsBadWritePtr GetProcAddress GetTempFileNameA LoadLibraryA DeleteCriticalSection GetVersionExA CloseHandle GetTempPathA HeapReAlloc HeapAlloc HeapFree GetProcessHeap SetEvent Sleep CreateEventA ResetEvent GetModuleFileNameA VirtualProtect CreateThread CreateFileA lstrcmpA MoveFileExA lstrcpynA GetFileAttributesA GetEnvironmentVariableA FindFirstFileA GetLastError CopyFileA CreateProcessA FindClose OpenEventA FindNextFileA CreateRemoteThread GetLocalTime VirtualAllocEx GetCurrentProcessId WriteProcessMemory WaitNamedPipeA ConnectNamedPipe ReadFile GetOverlappedResult DisconnectNamedPipe CreateNamedPipeA SetNamedPipeHandleState WaitForMultipleObjects lstrcpyA lstrcmpiA lstrcatA EnterCriticalSection LeaveCriticalSection lstrlenA OpenProcess InitializeCriticalSection WriteFile WaitForSingleObject SetFileAttributesA FreeLibrary GetCurrentProcess GetModuleHandleA FlushInstructionCache CreateEventW GetComputerNameExA GetTickCount

advapi32

CheckTokenMembership AllocateAndInitializeSid RegCloseKey RegEnumKeyA RegCreateKeyExA RegQueryValueExA CryptHashData CryptDestroyHash CryptDecrypt RegOpenKeyA RegEnumValueA RegDeleteValueA RegQueryInfoKeyA CryptDestroyKey CryptGenKey CryptCreateHash RegCreateKeyA RegSetValueExA CryptEncrypt CryptImportKey CryptReleaseContext CryptAcquireContextW CryptExportKey CryptGetHashParam FreeSid

dnsapi

DnsQuery_A DnsFree

wininet

InternetCloseHandle InternetOpenA HttpSendRequestA HttpAddRequestHeadersA HttpOpenRequestA InternetCrackUrlA InternetConnectA HttpQueryInfoA InternetTimeFromSystemTimeA