jaffacakes118_Trojan-Dropper[.]Win32[.]FrauDrop[.]aivkv[.]91162742affef8460e721c08d57c87c0

General

Target
jaffacakes118_Trojan-Dropper.Win32.FrauDrop.aivkv.91162742affef8460e721c08d57c87c0
Size 7.9MB
Sample261009-xdafsastdw
SHA256 21c7791451c26f5ca9b436e40fa91a93785b10097723b6741d843b2125ff35c1
MD5 91162742affef8460e721c08d57c87c0
SHA1 d63a5ee4f94eb0803e0cd481f7f483e9fa4d0e11
SHA512 ec57b78493afce1124c3e31175ca5b267590b4a4d073e4ce45c8681336157a9f7d7c1251075cb1b3eda885b17517dc01c2c2582d4289d5d9333c554b68a3b2a6
SSDEEP 196608:wA3Dl5WAjDfmEkYzCtBv62aSjvsreKDmgCBnPlmqj:wA3D12EkaC1aS7srlDmgCBnPlZj
TLSH
T1A38633A2B7824E75C46D29304C6A8544DE677D7844C4A80A3FB9FA8F0FBD79248B6F50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

installer

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan-Dropper.Win32.FrauDrop.aivkv.91162742affef8460e721c08d57c87c0

Inno Setup is an open-source installation builder for Windows applications. 1 IoCs

Inno Setup installer

installer

resource	yara_rule
sample	innosetup

File Explorer

jaffacakes118_Trojan-Dropper.Win32.FrauDrop.aivkv.91162742affef8460e721c08d57c87c0

.exe 7.9MB

jaffacakes118_Trojan-Dropper.Win32.FrauDrop.aivkv.91162742affef8460e721c08d57c87c0

IMPHASH a24e57cfb1e35030a9b4252bf1fa8b4b
SHA256 21c7791451c26f5ca9b436e40fa91a93785b10097723b6741d843b2125ff35c1
MD5 91162742affef8460e721c08d57c87c0
SHA1 d63a5ee4f94eb0803e0cd481f7f483e9fa4d0e11
SHA512 ec57b78493afce1124c3e31175ca5b267590b4a4d073e4ce45c8681336157a9f7d7c1251075cb1b3eda885b17517dc01c2c2582d4289d5d9333c554b68a3b2a6
SSDEEP 196608:wA3Dl5WAjDfmEkYzCtBv62aSjvsreKDmgCBnPlmqj:wA3D12EkaC1aS7srlDmgCBnPlZj
TLSH
T1A38633A2B7824E75C46D29304C6A8544DE677D7844C4A80A3FB9FA8F0FBD79248B6F50
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
Inno Setup is an open-source installation builder for Windows applications.

Inno Setup installer

installer

Minor OS version

0

Major OS version

4

Entry point

7581

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

lstrcmpiA lstrcpyA lstrlenA _lclose RemoveDirectoryA DeleteFileA GetModuleFileNameA _lread _llseek _lopen GetDiskFreeSpaceA SetCurrentDirectoryA CreateDirectoryA GetFileAttributesA lstrcatA GetTempPathA GetCurrentDirectoryA _lwrite _lcreat CloseHandle GetExitCodeProcess CreateProcessA ExitProcess TerminateProcess GetCurrentProcess HeapFree HeapAlloc GetModuleHandleA GetStartupInfoA GetCommandLineA GetVersion InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetEnvironmentVariableA GetVersionExA HeapDestroy HeapCreate VirtualFree VirtualAlloc HeapReAlloc RtlUnwind UnhandledExceptionFilter FreeEnvironmentStringsA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStrings GetEnvironmentStringsW SetHandleCount GetStdHandle GetFileType GetCurrentThreadId TlsSetValue TlsAlloc SetLastError TlsGetValue GetLastError WriteFile GetCPInfo GetACP GetOEMCP GetProcAddress LoadLibraryA InterlockedDecrement InterlockedIncrement MultiByteToWideChar LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW

user32

TranslateMessage DispatchMessageA PeekMessageA MsgWaitForMultipleObjects wsprintfA LoadCursorA SetCursor MessageBoxA

Sharing