jaffacakes118_Trojan-Dropper[.]Win32[.]Dycler[.]qwf[.]ece1e306ebb303450a8b25185f20a4c8

General

Target
jaffacakes118_Trojan-Dropper.Win32.Dycler.qwf.ece1e306ebb303450a8b25185f20a4c8
Size 582KB
Sample261009-w9dmmsdf29
SHA256 219bb22cbb6e64663629acd734fda38afd951fcc8b574dfc061a6a2bb4ec62b8
MD5 ece1e306ebb303450a8b25185f20a4c8
SHA1 5c2b09f075f57812b95dc46ef2042e294bac66b3
SHA512 f020e2271487e2f77e886392ec17ad411ccf3245977939c36890202de3bb2a93a4d324a4a8f2d5a0f57704bc907618dcaec420d5c83d926160084f6d196e3848
SSDEEP 12288:AHXsoVYdO2nnn/MkXQ+ctS3Qlp8iPHQOKKIFrTGCe6L:A8FnnnE9+vW2iPHvINteQ
TLSH
T11CC45B82E3877872C336D2B9016A2F33E97DDEED133A98C767922D71492018159F5E78
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan-Dropper.Win32.Dycler.qwf.ece1e306ebb303450a8b25185f20a4c8

File Explorer

jaffacakes118_Trojan-Dropper.Win32.Dycler.qwf.ece1e306ebb303450a8b25185f20a4c8

.exe 582KB

jaffacakes118_Trojan-Dropper.Win32.Dycler.qwf.ece1e306ebb303450a8b25185f20a4c8

IMPHASH db9bdf8c7d60a25ee8cbbbbd0ecdd54c
SHA256 219bb22cbb6e64663629acd734fda38afd951fcc8b574dfc061a6a2bb4ec62b8
MD5 ece1e306ebb303450a8b25185f20a4c8
SHA1 5c2b09f075f57812b95dc46ef2042e294bac66b3
SHA512 f020e2271487e2f77e886392ec17ad411ccf3245977939c36890202de3bb2a93a4d324a4a8f2d5a0f57704bc907618dcaec420d5c83d926160084f6d196e3848
SSDEEP 12288:AHXsoVYdO2nnn/MkXQ+ctS3Qlp8iPHQOKKIFrTGCe6L:A8FnnnE9+vW2iPHvINteQ
TLSH
T11CC45B82E3877872C336D2B9016A2F33E97DDEED133A98C767922D71492018159F5E78
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

21641

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Y:\Mars\Release\USBExe.pdb

kernel32

VirtualProtectEx WriteProcessMemory FlushInstructionCache GetCurrentProcess GetStdHandle SetErrorMode Sleep GetTempPathA lstrcmpiA lstrcpyA GetSystemTime SetFileAttributesA lstrcatA CopyFileA TerminateThread ResumeThread GetCurrentThreadId CreateThread GetModuleFileNameA OpenMutexA OpenProcess GetModuleHandleA CreateRemoteThread CreateToolhelp32Snapshot Thread32First OpenThread WaitForSingleObjectEx Thread32Next Process32First Process32Next GetTickCount DeleteFileA VirtualAlloc VirtualFree FindResourceA SizeofResource LoadResource WriteFile FreeLibrary lstrlenA GetVersionExA GetFileAttributesA GetModuleFileNameW lstrcpynW lstrcatW CreateDirectoryW SetFileAttributesW MoveFileExW DeleteFileW GetShortPathNameW GetEnvironmentVariableW lstrcpyW SetPriorityClass SetThreadPriority GetCurrentThread GetDriveTypeA GetLastError SetFilePointer CreateFileW WriteConsoleW LoadLibraryW HeapReAlloc GetStringTypeW IsValidCodePage GetOEMCP GetACP SetEndOfFile HeapSize GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter GetEnvironmentStringsW CreateDirectoryA CreateProcessA UnmapViewOfFile IsBadReadPtr MapViewOfFile CloseHandle CreateFileMappingA CreateFileA HeapFree VirtualAllocEx GetProcessHeap HeapAlloc GetProcAddress LoadLibraryA LockResource ReadProcessMemory FreeEnvironmentStringsW SetLastError TlsFree TlsSetValue TlsGetValue TlsAlloc FlushFileBuffers ReadFile GetConsoleMode InterlockedIncrement InterlockedDecrement InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection EncodePointer DecodePointer SetStdHandle InitializeCriticalSectionAndSpinCount GetFileType GetCommandLineA HeapSetInformation GetStartupInfoW RaiseException RtlUnwind WideCharToMultiByte LCMapStringW MultiByteToWideChar GetCPInfo TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetModuleHandleW ExitProcess HeapCreate IsProcessorFeaturePresent SetHandleCount GetConsoleCP

user32

SendMessageA MessageBoxA ShowWindow PostThreadMessageA DefWindowProcA PostQuitMessage UpdateWindow CreateWindowExA RegisterClassExA LoadCursorA LoadIconA DispatchMessageA TranslateMessage TranslateAcceleratorA LoadAcceleratorsA LoadStringA GetMessageA

advapi32

CryptGetHashParam CryptHashData CryptCreateHash CryptReleaseContext CryptAcquireContextA RegCloseKey RegSetValueExA RegCreateKeyA RegOpenKeyExA CryptDestroyHash

shell32

ShellExecuteA SHCreateDirectoryExA ShellExecuteExW

Sharing