jaffacakes118_Trojan-Dropper[.]Win32[.]Dapato[.]odlz[.]84de136b8c48bbe26af35d929b1df780

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan-Dropper.Win32.Dapato.odlz.84de136b8c48bbe26af35d929b1df780
Size 979KB
Sample261009-weelfscv2w
SHA256 b70a75bb2ecb3de97911deff051547ec1f0d7d62b99af77bb8bfa72c4a26d7db
MD5 84de136b8c48bbe26af35d929b1df780
SHA1 8744ec1982e92b6a88305164f39768b5daf30e56
SHA512 8df44a2e4aca43381fa74f9f1b90e3d72b4c15737061282a65c10d8d9ff14f9bc0cae755ba5e652aac22650f5ff416e2c727602e4d67376c5dfb6e845d64db50
SSDEEP 24576:tkKYiBNXyFX7b/aGY34rcaOAiYDmb02dg/aoppCusuVS6H7kR7zUrr4XOiPsT+vq:ezMNeH/+348YDW02dg/aoppCusuVS27T
TLSH
T1A425CE22B181C077D5730172896AF72159FEFA300D32864BB7E86A5D5FB08C27B2A757
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan-Dropper.Win32.Dapato.odlz.84de136b8c48bbe26af35d929b1df780

File Explorer

jaffacakes118_Trojan-Dropper.Win32.Dapato.odlz.84de136b8c48bbe26af35d929b1df780

.exe 979KB

jaffacakes118_Trojan-Dropper.Win32.Dapato.odlz.84de136b8c48bbe26af35d929b1df780

IMPHASH 0c5f432a717f6a6520cd516fe554631c
SHA256 b70a75bb2ecb3de97911deff051547ec1f0d7d62b99af77bb8bfa72c4a26d7db
MD5 84de136b8c48bbe26af35d929b1df780
SHA1 8744ec1982e92b6a88305164f39768b5daf30e56
SHA512 8df44a2e4aca43381fa74f9f1b90e3d72b4c15737061282a65c10d8d9ff14f9bc0cae755ba5e652aac22650f5ff416e2c727602e4d67376c5dfb6e845d64db50
SSDEEP 24576:tkKYiBNXyFX7b/aGY34rcaOAiYDmb02dg/aoppCusuVS6H7kR7zUrr4XOiPsT+vq:ezMNeH/+348YDW02dg/aoppCusuVS27T
TLSH
T1A425CE22B181C077D5730172896AF72159FEFA300D32864BB7E86A5D5FB08C27B2A757
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

540345

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ws2_32

closesocket htons WSAStartup socket connect recv htonl send gethostbyname

kernel32

SetFilePointerEx FlushFileBuffers UnmapViewOfFile CreateFileMappingW MapViewOfFile GetTempPathW GetFileAttributesW GetFileAttributesExW GetCurrentDirectoryW InterlockedCompareExchange SetFilePointer CreateMutexW WaitForSingleObject ReleaseMutex CreateProcessW FormatMessageA InterlockedExchangeAdd MultiByteToWideChar WideCharToMultiByte EnterCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection DeleteCriticalSection Sleep CreateEventW GetProcAddress GetCurrentThreadId GetCurrentProcess GetNativeSystemInfo GetModuleHandleW GetVolumeInformationW LocalFree GetComputerNameW AreFileApisANSI GetDiskFreeSpaceW InitializeCriticalSection GetFullPathNameA GetTempPathA FormatMessageW GetDiskFreeSpaceA GetFileAttributesA CreateFileA LoadLibraryA DeleteFileA DeleteFileW LoadLibraryW LockFileEx GetFileSize GetCurrentProcessId FreeLibrary GetSystemTimeAsFileTime GetSystemTime QueryPerformanceCounter GetTickCount RemoveDirectoryW GetCommandLineW TerminateProcess OpenProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW HeapSize WriteConsoleW FindNextFileA FindFirstFileExA GetCommandLineA SetEnvironmentVariableW SetEnvironmentVariableA UnlockFile CreateFileW SetEndOfFile LockFile WriteFile GetFileSizeEx ReadFile CloseHandle GetWindowsDirectoryW GetSystemDirectoryW GetModuleFileNameW GetLastError GetVersionExW FindClose FindNextFileW GetFullPathNameW FindFirstFileW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage GetProcessHeap GetTimeZoneInformation SetStdHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetConsoleCP GetStringTypeW EncodePointer DecodePointer SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo SetEvent ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead RaiseException RtlUnwind LoadLibraryExW GetDriveTypeW GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ExitProcess GetModuleHandleExW CreateDirectoryW SetFileAttributesW QueryPerformanceFrequency HeapAlloc HeapReAlloc HeapFree GetStdHandle GetModuleFileNameA GetACP GetConsoleMode ReadConsoleW

user32

MessageBoxW ShowWindow IsWindowVisible GetWindow PostMessageW EnumWindows GetWindowThreadProcessId

advapi32

GetUserNameW RegOpenKeyW ConvertSidToStringSidW LookupAccountNameW CryptDestroyKey CryptSetHashParam CryptImportKey RegCloseKey RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegQueryValueExW CryptAcquireContextW CryptCreateHash CryptHashData CryptDestroyHash CryptGetHashParam CryptReleaseContext UnlockServiceDatabase CloseServiceHandle OpenSCManagerW LockServiceDatabase SystemFunction036

shell32

ShellExecuteW ShellExecuteA CommandLineToArgvW SHGetFolderPathW

ole32

CoTaskMemFree

Name

.text

Size

707KB

Virtual Size

707KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

224KB

Virtual Size

224KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

30KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_Trojan-Dropper.Win32.Dapato.odlz.84de136b8c48bbe26af35d929b1df780

ws2_32

kernel32

user32

advapi32

shell32

ole32

generic