jaffacakes118_HEUR[.]Trojan[.]Win32[.]Generic[.]e0ebaa17c0f129f65cb476b78f20bf07

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.e0ebaa17c0f129f65cb476b78f20bf07
Size 923KB
Sample261009-vmd48ach67
SHA256 1ea7040e29f888c58bdcca4a1724f339bfd53f66929330499643a4affb4ef9f7
MD5 e0ebaa17c0f129f65cb476b78f20bf07
SHA1 b8aa1ae45b9a5de50782c3f190ee030d0606af2e
SHA512 e5d48d18d19903c65b1faf0cc878c78163224c54a6ecb6fcc73451feb2827b12d6da80413387af00e3f5d28f26195c548312ba9588d3faf3545abcecd2a373ec
SSDEEP 24576:aZtt1WCLFB+K/vyplxZ52QXEhilhJvyUAFi25Q:atjLjyVn2QXvlAFi5
TLSH
T142152301E928B29DCCB86031F732B8A578F5EE36E149452BD9F4BD9D3B3C8148C95B16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_HEUR.Trojan.Win32.Generic.e0ebaa17c0f129f65cb476b78f20bf07

File Explorer

jaffacakes118_HEUR.Trojan.Win32.Generic.e0ebaa17c0f129f65cb476b78f20bf07

.dll 923KB

jaffacakes118_HEUR.Trojan.Win32.Generic.e0ebaa17c0f129f65cb476b78f20bf07

IMPHASH ba64feedda867bb46691c63f0345f2b1
SHA256 1ea7040e29f888c58bdcca4a1724f339bfd53f66929330499643a4affb4ef9f7
MD5 e0ebaa17c0f129f65cb476b78f20bf07
SHA1 b8aa1ae45b9a5de50782c3f190ee030d0606af2e
SHA512 e5d48d18d19903c65b1faf0cc878c78163224c54a6ecb6fcc73451feb2827b12d6da80413387af00e3f5d28f26195c548312ba9588d3faf3545abcecd2a373ec
SSDEEP 24576:aZtt1WCLFB+K/vyplxZ52QXEhilhJvyUAFi25Q:atjLjyVn2QXvlAFi5
TLSH
T142152301E928B29DCCB86031F732B8A578F5EE36E149452BD9F4BD9D3B3C8148C95B16
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

126977

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetLastError GetTempPathW MultiByteToWideChar TlsGetValue CreateMutexW CreateEventW SetFileAttributesW GetEnvironmentStringsW GetCommandLineW RtlUnwind CreateFileA GetOEMCP FlushFileBuffers VirtualAlloc lstrcpyW WideCharToMultiByte GetVersionExW GlobalFree UnhandledExceptionFilter GetModuleHandleW SetFilePointer HeapAlloc GetModuleHandleA GlobalLock WriteConsoleA TerminateProcess EnterCriticalSection lstrcmpiW FindResourceW HeapFree GetLastError SetStdHandle FreeEnvironmentStringsW GetProcessHeap TlsAlloc GetDriveTypeW CloseHandle GetFileAttributesW OutputDebugStringW TlsFree LoadLibraryA RaiseException SetEvent WriteConsoleW GetLocaleInfoA WriteFile SetUnhandledExceptionFilter GetACP GetConsoleMode LoadLibraryExW GetModuleFileNameA GetCurrentProcessId LeaveCriticalSection lstrlenA InterlockedIncrement LoadLibraryW FreeLibrary ExitProcess IsProcessorFeaturePresent FlushInstructionCache ResetEvent HeapSize GetStringTypeA GetStringTypeW Sleep GetCurrentProcess InterlockedCompareExchange InterlockedDecrement QueryPerformanceCounter SizeofResource ReadFile TlsSetValue LCMapStringA VirtualFree GetSystemTimeAsFileTime SetHandleCount InterlockedExchange WaitForSingleObject GetFileType GlobalSize GetProcAddress GetStartupInfoA GetModuleFileNameW LoadResource LCMapStringW GetConsoleCP GlobalAlloc GetCurrentThreadId IsDebuggerPresent InitializeCriticalSection lstrcpynW CopyFileExW GlobalUnlock GetStartupInfoW lstrlenW HeapReAlloc IsValidCodePage GetCPInfo DebugBreak CreateThread InitializeCriticalSectionAndSpinCount GetTickCount MoveFileExW GetStdHandle HeapCreate CreateFileW GetConsoleOutputCP DeleteCriticalSection

user32

DefWindowProcW PostQuitMessage GetClipboardData CloseClipboard PostMessageW SetClipboardData OpenClipboard ShowWindow SetWindowLongW GetMessageW GetWindowLongW EmptyClipboard LoadCursorW DispatchMessageW CallWindowProcW FindWindowW PeekMessageW CreateWindowExW GetClassInfoExW LoadIconW CharNextW TranslateMessage DestroyWindow LoadStringW CharPrevW RegisterClassExW IsWindow wvsprintfW UnregisterClassA CharLowerW

advapi32

RegEnumKeyExW RegSetValueExW RegCloseKey RegDeleteKeyW RegOpenKeyExW RegQueryInfoKeyW RegDeleteValueW RegCreateKeyExW

ole32

CoUninitialize CoTaskMemAlloc CoCreateInstance CoInitialize OleInitialize OleUninitialize CoTaskMemRealloc CoTaskMemFree

oleaut32

SysAllocStringLen VariantClear SysAllocStringByteLen SysFreeString SysStringByteLen VarUI4FromStr VariantInit SysAllocString

winmm

timeGetTime

secur32

QuerySecurityPackageInfoA

wldap32

ord60

Name

.text

Size

119KB

Virtual Size

119KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.xyu

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

694KB

Virtual Size

694KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

101KB

Virtual Size

497KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_HEUR.Trojan.Win32.Generic.e0ebaa17c0f129f65cb476b78f20bf07

kernel32

user32

advapi32

ole32

oleaut32

winmm

secur32

wldap32

generic