jaffacakes118_HEUR[.]Trojan[.]Win32[.]StartPage[.]a19b2c732c92341da6ecdb5dfd3405ff

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_HEUR.Trojan.Win32.StartPage.a19b2c732c92341da6ecdb5dfd3405ff
Size 1.3MB
Sample261009-vqhltada39
SHA256 3bfd548b304eb1deb55d61460073b7f96a2f13bab123454da86405373a29d3e0
MD5 a19b2c732c92341da6ecdb5dfd3405ff
SHA1 94aa9d06debd576fade5b3d2216b8d591c0b7302
SHA512 17087900ac96a6d3582bb8207db73f72c3c7adb907f59f4df6ed02bf9481e0e0e241eeb98c52a5a11f31a3862737a69812a63e96301a1826d8a469eb3a546ee5
SSDEEP 12288:jiLJ5i7sJXx0douBjhCCAYi8c1i6oaeNSoeDlHsg+2Vasj0eqVl:OspfjxAf8c46oaKeD5l+25j0tVl
TLSH
T18655B53166D14061E2723A31DD24DDEE342A7DB00FD69D9F9294372907B45F2CE3AE2A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_HEUR.Trojan.Win32.StartPage.a19b2c732c92341da6ecdb5dfd3405ff

File Explorer

jaffacakes118_HEUR.Trojan.Win32.StartPage.a19b2c732c92341da6ecdb5dfd3405ff

.exe 1.3MB

jaffacakes118_HEUR.Trojan.Win32.StartPage.a19b2c732c92341da6ecdb5dfd3405ff

IMPHASH 9a473010e067adbb657740f2fdb0c484
SHA256 3bfd548b304eb1deb55d61460073b7f96a2f13bab123454da86405373a29d3e0
MD5 a19b2c732c92341da6ecdb5dfd3405ff
SHA1 94aa9d06debd576fade5b3d2216b8d591c0b7302
SHA512 17087900ac96a6d3582bb8207db73f72c3c7adb907f59f4df6ed02bf9481e0e0e241eeb98c52a5a11f31a3862737a69812a63e96301a1826d8a469eb3a546ee5
SSDEEP 12288:jiLJ5i7sJXx0douBjhCCAYi8c1i6oaeNSoeDlHsg+2Vasj0eqVl:OspfjxAf8c46oaKeD5l+25j0tVl
TLSH
T18655B53166D14061E2723A31DD24DDEE342A7DB00FD69D9F9294372907B45F2CE3AE2A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

151104

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

oleacc

AccessibleObjectFromWindow

kernel32

InterlockedIncrement lstrcmpiW LoadLibraryExW EncodePointer LeaveCriticalSection InterlockedDecrement EnterCriticalSection WideCharToMultiByte GetCurrentProcessId CreateThread MultiByteToWideChar SetFileAttributesW GetFileAttributesW GetProcessId GetModuleFileNameW CreateDirectoryW MulDiv GetModuleHandleW GetProcessHeap ReadConsoleW SetEndOfFile WriteConsoleW SetFilePointerEx FlushFileBuffers SetStdHandle FreeLibrary FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetConsoleMode GetConsoleCP EnumSystemLocalesW GetUserDefaultLCID DeleteCriticalSection HeapDestroy DecodePointer HeapAlloc ReadFile FindResourceW LoadResource FindResourceExW RaiseException HeapReAlloc LockResource GetLastError Sleep HeapSize InitializeCriticalSectionAndSpinCount HeapFree SizeofResource GetProcAddress IsValidLocale GetFileType GetACP WriteFile GetStdHandle GetModuleHandleExW ExitProcess VirtualQuery VirtualProtect GetSystemInfo RtlUnwind GetLocaleInfoW LCMapStringW CompareStringW GetCPInfo TlsFree TlsSetValue TlsGetValue TlsAlloc GetStringTypeW LoadLibraryExA VirtualFree VirtualAlloc FlushInstructionCache InterlockedPushEntrySList SetLastError GetCurrentProcess GetEnvironmentVariableW FormatMessageW CloseHandle LocalFree OutputDebugStringW SetFilePointer CreateFileW GetFileSize GetCurrentThreadId GlobalAlloc GlobalLock GlobalUnlock lstrcmpW SetEvent ResetEvent WaitForSingleObjectEx CreateEventW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead InterlockedPopEntrySList

user32

UpdateWindow GetDesktopWindow ReleaseDC EndPaint BeginPaint KillTimer CallWindowProcW PostMessageW CharNextW MessageBoxW ShowWindow InvalidateRect GetWindowLongW GetWindowThreadProcessId GetMessageW DefWindowProcW GetWindowRect DestroyWindow GetDC IsWindowVisible SetWindowPos EqualRect EnumChildWindows CreateWindowExW GetSystemMetrics UnregisterClassW RegisterClassExW IsWindow DispatchMessageW SetTimer PeekMessageW GetWindowTextW GetCursorPos SetForegroundWindow ReleaseCapture RegisterWindowMessageW GetParent GetClassInfoExW GetDlgItem GetClientRect SetCapture SetFocus CreateAcceleratorTableW GetSysColor IsChild DestroyAcceleratorTable ClientToScreen RedrawWindow InvalidateRgn SetWindowTextW SendMessageW ScreenToClient FillRect GetFocus GetWindow GetWindowTextLengthW MoveWindow EnumWindows LoadBitmapW SetLayeredWindowAttributes TranslateMessage LoadCursorW GetClassNameW SetWindowLongW DrawTextW

gdi32

GetObjectW DeleteDC GetStockObject CreateCompatibleBitmap CreateSolidBrush CreateFontIndirectW SetBkMode SetTextColor GetDIBits CreateCompatibleDC SelectObject BitBlt DeleteObject GetDeviceCaps

advapi32

CryptAcquireContextW RegEnumKeyW RegQueryInfoKeyW RegDeleteKeyW RegEnumKeyExW RegOpenKeyExW RegDeleteValueW RegCloseKey RegCreateKeyExW RegSetValueExW CryptCreateHash CryptHashData CryptDestroyHash CryptGetHashParam RegQueryValueExW CryptReleaseContext

shell32

SHGetFolderPathW ShellExecuteW ShellExecuteExW

ole32

OleLockRunning CoGetClassObject OleUninitialize StringFromGUID2 CoTaskMemRealloc CreateStreamOnHGlobal OleInitialize CLSIDFromString CLSIDFromProgID CoCreateGuid CoTaskMemFree CoCreateInstance CoTaskMemAlloc CoUninitialize CoInitialize

oleaut32

LoadTypeLi OleCreateFontIndirect VarBstrCat SysStringLen SysAllocStringLen LoadRegTypeLi VariantClear VarBstrCmp SysAllocString SysFreeString VariantInit VarUI4FromStr

shlwapi

UrlEscapeW UrlUnescapeW PathAppendW PathAddBackslashW

wininet

InternetCloseHandle HttpSendRequestW InternetCrackUrlW InternetOpenW HttpOpenRequestW InternetConnectW