jaffacakes118_Hoax[.]Win32[.]AutoFixerPro[.]a[.]9b7f2b228908a848faeb174fdced55ec

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Hoax.Win32.AutoFixerPro.a.9b7f2b228908a848faeb174fdced55ec
Size 4.3MB
Sample261009-vr93fsda72
SHA256 cf106c30d0a83a9733ca491769f2afd86a99af0789dc6d9625918769d180451f
MD5 9b7f2b228908a848faeb174fdced55ec
SHA1 c35342fa52dab3a4e5b37272b0986d1b9a1c52b2
SHA512 10913cd675ec6c708fbac8d91c956afd1d8d303c195bde6ffe9d9b2f1ed8e9a9c368ab83e5e1eb7b55c90599b74c030d9a56aeb648d309dbb8aba31405a0e6b2
SSDEEP 98304:VkJeW67eKGcsx59j9WFTTI69xWq8xlaSAeenRu1ZynR4d4:VkuNGJx5jWOOxZO0YenY1ZY4e
TLSH
T120263327B7D70072F466687D9DB780255C637CA52AE1A0C82D3CDE0EA6F89C198F7712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

installer

Malware Config

Signatures

Insecure Codesign Algorithm 1 IoCs

File was codesigned using an insecure algorithm.

resource
jaffacakes118_Hoax.Win32.AutoFixerPro.a.9b7f2b228908a848faeb174fdced55ec

Inno Setup is an open-source installation builder for Windows applications. 1 IoCs

Inno Setup installer

installer

resource	yara_rule
sample	innosetup

File Explorer

jaffacakes118_Hoax.Win32.AutoFixerPro.a.9b7f2b228908a848faeb174fdced55ec

.exe 4.3MB

jaffacakes118_Hoax.Win32.AutoFixerPro.a.9b7f2b228908a848faeb174fdced55ec

IMPHASH 48aa5c8931746a9655524f67b25a47ef
SHA256 cf106c30d0a83a9733ca491769f2afd86a99af0789dc6d9625918769d180451f
MD5 9b7f2b228908a848faeb174fdced55ec
SHA1 c35342fa52dab3a4e5b37272b0986d1b9a1c52b2
SHA512 10913cd675ec6c708fbac8d91c956afd1d8d303c195bde6ffe9d9b2f1ed8e9a9c368ab83e5e1eb7b55c90599b74c030d9a56aeb648d309dbb8aba31405a0e6b2
SSDEEP 98304:VkJeW67eKGcsx59j9WFTTI69xWq8xlaSAeenRu1ZynR4d4:VkuNGJx5jWOOxZO0YenY1ZY4e
TLSH
T120263327B7D70072F466687D9DB780255C637CA52AE1A0C82D3CDE0EA6F89C198F7712
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.
Inno Setup is an open-source installation builder for Windows applications.

Inno Setup installer

installer

Digest

6b:b8:af:56:0b:1b:ec:ac:98:2b:34:40:38:8b:f8:c9:e5:a0:ae:52

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=CONNECT AB INFOLINE PRIVATE LIMITED,O=CONNECT AB INFOLINE PRIVATE LIMITED,POSTALCODE=110092,STREET=706\, PLOT NO. 7\, ROOTS TOWER,L=New Delhi,ST=New Delhi,C=IN

Chains

Mar 28, 2018

CN=CONNECT AB INFOLINE PRIVATE LIMITED,O=CONNECT AB INFOLINE PRIVATE LIMITED,POSTALCODE=110092,STREET=706\, PLOT NO. 7\, ROOTS TOWER,L=New Delhi,ST=New Delhi,C=IN

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:2f:4e:e1:52:d7

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 13, 2011 - Jan 28, 2028

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Serial Number

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 24, 2016 - Jun 24, 2027

Subject

CN=CONNECT AB INFOLINE PRIVATE LIMITED,O=CONNECT AB INFOLINE PRIVATE LIMITED,POSTALCODE=110092,STREET=706\, PLOT NO. 7\, ROOTS TOWER,L=New Delhi,ST=New Delhi,C=IN

Serial Number

f0:68:02:eb:9b:78:f1:46:e9:16:4d:ef:c8:2e:f2:cd

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 21, 2018 - Jun 1, 2018

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 9, 2013 - May 8, 2028

Minor OS version

Major OS version

Entry point

70588

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

oleaut32

SysFreeString SysReAllocStringLen SysAllocStringLen

advapi32

RegQueryValueExW RegOpenKeyExW RegCloseKey RegQueryValueExW RegOpenKeyExW RegCloseKey OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges

user32

GetKeyboardType LoadStringW MessageBoxA CharNextW CreateWindowExW TranslateMessage SetWindowLongW PeekMessageW MsgWaitForMultipleObjects MessageBoxW LoadStringW GetSystemMetrics ExitWindowsEx DispatchMessageW DestroyWindow CharUpperBuffW CallWindowProcW

kernel32

GetACP Sleep VirtualFree VirtualAlloc GetSystemInfo GetTickCount QueryPerformanceCounter GetVersion GetCurrentThreadId VirtualQuery WideCharToMultiByte MultiByteToWideChar lstrlenW lstrcpynW LoadLibraryExW GetThreadLocale GetStartupInfoA GetProcAddress GetModuleHandleW GetModuleFileNameW GetLocaleInfoW GetCommandLineW FreeLibrary FindFirstFileW FindClose ExitProcess WriteFile UnhandledExceptionFilter RtlUnwind RaiseException GetStdHandle CloseHandle TlsSetValue TlsGetValue LocalAlloc GetModuleHandleW WriteFile WideCharToMultiByte WaitForSingleObject VirtualQuery VirtualProtect VirtualFree VirtualAlloc SizeofResource SignalObjectAndWait SetLastError SetFilePointer SetEvent SetErrorMode SetEndOfFile ResetEvent RemoveDirectoryW ReadFile MultiByteToWideChar LockResource LoadResource LoadLibraryW GetWindowsDirectoryW GetVersionExW GetUserDefaultLangID GetThreadLocale GetSystemInfo GetStdHandle GetProcAddress GetModuleHandleW GetModuleFileNameW GetLocaleInfoW GetLastError GetFullPathNameW GetFileSize GetFileAttributesW GetExitCodeProcess GetEnvironmentVariableW GetDiskFreeSpaceW GetCurrentProcess GetCommandLineW GetCPInfo InterlockedExchange InterlockedCompareExchange FreeLibrary FormatMessageW FindResourceW EnumCalendarInfoW DeleteFileW CreateProcessW CreateFileW CreateEventW CreateDirectoryW CloseHandle Sleep

comctl32

InitCommonControls

Name

.text

Size

60KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

21KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

94KB

Virtual Size

94KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_Hoax.Win32.AutoFixerPro.a.9b7f2b228908a848faeb174fdced55ec

oleaut32

advapi32

user32

kernel32

comctl32

generic