jaffacakes118_Trojan-Dropper[.]Win32[.]Daws[.]awew[.]3f899c1a8c0e52187165410ed2f1598b

General

Target
jaffacakes118_Trojan-Dropper.Win32.Daws.awew.3f899c1a8c0e52187165410ed2f1598b
Size 134KB
Sample261009-wheqmacv5x
SHA256 a3f9a8c98c7ee05d870532889e0b899aef3da48c4153d5db61230ad71c8aeae2
MD5 3f899c1a8c0e52187165410ed2f1598b
SHA1 7e6a9c47912616ec59db582c782dbda795bd15fd
SHA512 2e7d6a39ded15a53434f665aa35618dfa79fbf0f883cb50028abb0d617437b0fa56a9fc7fcbe90487f9217d792a30193de57f85c735d9a25d0800c89a271c72d
SSDEEP 3072:xQalhfW5k7+aJe1mgawzxsBub86VywpZhKqio6ddOp:6al0TV5nzZa
TLSH
T1F1D3AF22B9C5C072D45640B51436CB719BBFBD32166893837B64BAFB5F332C5AD2B206
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan-Dropper.Win32.Daws.awew.3f899c1a8c0e52187165410ed2f1598b

File Explorer

jaffacakes118_Trojan-Dropper.Win32.Daws.awew.3f899c1a8c0e52187165410ed2f1598b

.exe 134KB

jaffacakes118_Trojan-Dropper.Win32.Daws.awew.3f899c1a8c0e52187165410ed2f1598b

IMPHASH 3a1b630eff9fc5a2bb662dfb47b0da28
SHA256 a3f9a8c98c7ee05d870532889e0b899aef3da48c4153d5db61230ad71c8aeae2
MD5 3f899c1a8c0e52187165410ed2f1598b
SHA1 7e6a9c47912616ec59db582c782dbda795bd15fd
SHA512 2e7d6a39ded15a53434f665aa35618dfa79fbf0f883cb50028abb0d617437b0fa56a9fc7fcbe90487f9217d792a30193de57f85c735d9a25d0800c89a271c72d
SSDEEP 3072:xQalhfW5k7+aJe1mgawzxsBub86VywpZhKqio6ddOp:6al0TV5nzZa
TLSH
T1F1D3AF22B9C5C072D45640B51436CB719BBFBD32166893837B64BAFB5F332C5AD2B206
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

6022

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Documents and Settings\ss\桌面\tls\scr\bind\bind\Release\bind.pdb

kernel32

FindResourceW LoadResource SizeofResource LockResource WinExec HeapAlloc GetCommandLineA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapFree VirtualFree VirtualAlloc HeapReAlloc HeapCreate GetModuleHandleW Sleep GetProcAddress ExitProcess WriteFile GetStdHandle GetModuleFileNameA RtlUnwind GetLastError WideCharToMultiByte GetConsoleCP GetConsoleMode CloseHandle FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType GetStartupInfoA TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount LoadLibraryA CreateFileA SetFilePointer WriteConsoleA GetConsoleOutputCP WriteConsoleW MultiByteToWideChar SetStdHandle FlushFileBuffers GetCPInfo GetACP GetOEMCP IsValidCodePage HeapSize GetLocaleInfoA SetEndOfFile GetProcessHeap ReadFile LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW

Sharing