jaffacakes118_Trojan-Dropper[.]Win32[.]Dapato[.]pckk[.]b734c30ac54873b2cdb84fb936ccf668

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan-Dropper.Win32.Dapato.pckk.b734c30ac54873b2cdb84fb936ccf668
Size 1.8MB
Sample261009-we93cssy8r
SHA256 b01464ffd5e80dcc8100c06cab63a16bb85698cdf63588f1d6d39c70ef77018d
MD5 b734c30ac54873b2cdb84fb936ccf668
SHA1 18a2ca19e00274c4fc40b60f10c976c0094b675a
SHA512 81813558272df8e5c3f2077e31d5ff0e0873b67bd39853ac66cd0c25ba058b2c9519066fc53b0bcc19d0b213666aa91f1d5b280e47a5d21e64393a503c91b58a
SSDEEP 49152:RzbZDEJIsIxTgACSqPRIXdqGvTop/QhVvw4j:Rz2dIx6SldOQ
TLSH
T13B959E02A7C080B2E64E17751167E7BA5E399D354328C5CBD7A03D759E312D3AA3B38E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan-Dropper.Win32.Dapato.pckk.b734c30ac54873b2cdb84fb936ccf668

File Explorer

jaffacakes118_Trojan-Dropper.Win32.Dapato.pckk.b734c30ac54873b2cdb84fb936ccf668

.exe 1.8MB

jaffacakes118_Trojan-Dropper.Win32.Dapato.pckk.b734c30ac54873b2cdb84fb936ccf668

IMPHASH d316db7770971c1da94875ed04f192fe
SHA256 b01464ffd5e80dcc8100c06cab63a16bb85698cdf63588f1d6d39c70ef77018d
MD5 b734c30ac54873b2cdb84fb936ccf668
SHA1 18a2ca19e00274c4fc40b60f10c976c0094b675a
SHA512 81813558272df8e5c3f2077e31d5ff0e0873b67bd39853ac66cd0c25ba058b2c9519066fc53b0bcc19d0b213666aa91f1d5b280e47a5d21e64393a503c91b58a
SSDEEP 49152:RzbZDEJIsIxTgACSqPRIXdqGvTop/QhVvw4j:Rz2dIx6SldOQ
TLSH
T13B959E02A7C080B2E64E17751167E7BA5E399D354328C5CBD7A03D759E312D3AA3B38E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

15986

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

F:\开发\项目集合\服务启动\Release\OpenServer.pdb

kernel32

GetModuleFileNameW SetPriorityClass SetThreadPriority GetCurrentThread Sleep SetFileAttributesW lstrlenW GetLastError SizeofResource LockResource FreeResource LoadResource FindResourceW FindClose FindNextFileW FindFirstFileW CloseHandle GetFileAttributesW GetCurrentProcess CreateFileA ReadFile GetProcessHeap SetEndOfFile LCMapStringW LCMapStringA GetStringTypeW GetStringTypeA TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetStartupInfoW RaiseException RtlUnwind HeapFree HeapAlloc GetModuleHandleW GetProcAddress TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement HeapSize ExitProcess EnterCriticalSection LeaveCriticalSection WriteFile WideCharToMultiByte GetConsoleCP GetConsoleMode GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA DeleteCriticalSection HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime VirtualAlloc HeapReAlloc GetCPInfo GetACP GetOEMCP IsValidCodePage LoadLibraryA InitializeCriticalSectionAndSpinCount SetFilePointer MultiByteToWideChar CreateFileW WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle FlushFileBuffers GetLocaleInfoA

user32

wsprintfW

advapi32

RegSetValueExW RegQueryValueExW RegCreateKeyExW RegOpenKeyExW RegCloseKey AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken

shell32

SHChangeNotify ShellExecuteW SHGetSpecialFolderPathW

shlwapi

PathFileExistsW

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW