jaffacakes118_Trojan-Dropper[.]Win32[.]Genome[.]fus[.]13021d8eccbc5900bc010a8ee116567d

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan-Dropper.Win32.Genome.fus.13021d8eccbc5900bc010a8ee116567d
Size 4.0MB
Sample261009-xffetadg44
SHA256 7b9883b26be7e30a5d5484c449220011c444209824d4e3651d5c28fb6adb91a1
MD5 13021d8eccbc5900bc010a8ee116567d
SHA1 9296c982e3194efea178dc72af854976bf84553d
SHA512 fe46cc7baea616db437bce1c5152cd8544ba3e0bb3406c0a6cafebbc8df4c5939a5df039249885290a84c91966734a7772429fe2e1d833a0a8e5b8a8ac913d9c
SSDEEP 98304:asKhhepGI5NXrA+6gJf6PD3Nmn7AJEgLYXMKUCCCNYzQEr0WO0Yk84GIcTfZTxqs:a/wG6G+NJiPD3Nm7AJEgLYX8CNYzQErl
TLSH
T16A169D347E4D5B98C96BD4B4B0AFC3A8C94849314BEC0EAEA0346D9165ABF51F36C4F1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan-Dropper.Win32.Genome.fus.13021d8eccbc5900bc010a8ee116567d

File Explorer

jaffacakes118_Trojan-Dropper.Win32.Genome.fus.13021d8eccbc5900bc010a8ee116567d

.exe 4.0MB

jaffacakes118_Trojan-Dropper.Win32.Genome.fus.13021d8eccbc5900bc010a8ee116567d

IMPHASH 5f8d7de9aa57704ebdf27ec039cfa891
SHA256 7b9883b26be7e30a5d5484c449220011c444209824d4e3651d5c28fb6adb91a1
MD5 13021d8eccbc5900bc010a8ee116567d
SHA1 9296c982e3194efea178dc72af854976bf84553d
SHA512 fe46cc7baea616db437bce1c5152cd8544ba3e0bb3406c0a6cafebbc8df4c5939a5df039249885290a84c91966734a7772429fe2e1d833a0a8e5b8a8ac913d9c
SSDEEP 98304:asKhhepGI5NXrA+6gJf6PD3Nmn7AJEgLYXMKUCCCNYzQEr0WO0Yk84GIcTfZTxqs:a/wG6G+NJiPD3Nm7AJEgLYX8CNYzQErl
TLSH
T16A169D347E4D5B98C96BD4B4B0AFC3A8C94849314BEC0EAEA0346D9165ABF51F36C4F1
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

123242

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

lstrcatA lstrlenA Sleep GetFileSize lstrcmpA ReadFile SetFilePointer GetModuleHandleA FreeLibrary MultiByteToWideChar CopyFileA GetSystemTime FindClose FindNextFileA FindFirstFileA EndUpdateResourceA UpdateResourceA BeginUpdateResourceA GetSystemDefaultLangID lstrcpyW lstrlenW CreateProcessA MoveFileA ExpandEnvironmentStringsA GetWindowsDirectoryW InitializeCriticalSection DuplicateHandle TerminateThread OpenProcess IsBadReadPtr SetLastError GetVersionExA WaitForSingleObject ResumeThread SetThreadContext GetThreadContext CreateEventA SuspendThread GetLastError SetEnvironmentVariableA CompareStringW CompareStringA FlushFileBuffers LCMapStringW LCMapStringA GetStringTypeW GetStringTypeA SetStdHandle GetOEMCP GetACP GetCPInfo IsBadCodePtr InterlockedIncrement InterlockedDecrement SetUnhandledExceptionFilter GetFileType GetStdHandle SetHandleCount GetEnvironmentStringsW GetEnvironmentStrings WideCharToMultiByte FreeEnvironmentStringsW FreeEnvironmentStringsA LeaveCriticalSection EnterCriticalSection DeleteCriticalSection IsBadWritePtr HeapCreate HeapDestroy GetEnvironmentVariableA HeapSize HeapReAlloc UnhandledExceptionFilter HeapAlloc TlsAlloc GetCurrentThreadId RaiseException ExitProcess GetVersion UnmapViewOfFile LoadLibraryA GetProcAddress CreateFileA WriteFile GetCurrentDirectoryA OpenFileMappingA GetCurrentProcessId GetSystemDirectoryA SetFileAttributesA GetModuleFileNameA VirtualProtect VirtualAlloc WinExec CreateToolhelp32Snapshot Process32First Process32Next Module32First Module32Next CloseHandle GetCurrentProcess TerminateProcess DeleteFileA GetCommandLineA GetStartupInfoA HeapFree RtlUnwind GetLocalTime GetTimeZoneInformation ExitThread TlsGetValue TlsSetValue CreateThread VirtualFree lstrcpyA CreateFileMappingA MapViewOfFile

user32

EndDialog SetTimer MessageBoxA SystemParametersInfoA IsDlgButtonChecked GetWindow GetClassNameA IsWindow GetTopWindow IsWindowVisible FindWindowA wsprintfA KillTimer LoadIconA GetDlgItem CheckDlgButton EnableWindow SetDlgItemTextA GetDlgItemTextA GetClassNameW GetWindowThreadProcessId GetKeyboardLayoutNameA GetKeyboardLayoutList UnloadKeyboardLayout ReleaseCapture ClientToScreen SetCursor SetCapture LoadBitmapA LoadCursorA WindowFromPoint GetParent PtInRect GetWindowDC GetWindowRect OffsetRect IsRectEmpty ReleaseDC DialogBoxParamA GetClassInfoExA RegisterClassExA WaitForInputIdle SendMessageA PeekMessageA TranslateMessage DispatchMessageA PostMessageA

gdi32

PatBlt

advapi32

AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken RegCloseKey RegEnumKeyExA RegCreateKeyA RegSetValueExA RegQueryValueExA RegOpenKeyExA RegDeleteKeyA RegOpenKeyA RegEnumValueA

shell32

ShellExecuteExA ShellExecuteA

ws2_32

inet_addr htons connect send select closesocket socket inet_ntoa gethostbyname WSAStartup recv __WSAFDIsSet

imm32

ImmGetDescriptionA ImmIsIME

shlwapi

PathFindExtensionA PathRemoveFileSpecA PathFileExistsA PathIsFileSpecA PathFindFileNameA StrCatW PathRenameExtensionA

version

VerQueryValueA GetFileVersionInfoSizeA GetFileVersionInfoA

Name

.text

Size

152KB

Virtual Size

149KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.6MB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text0

Size

68KB

Virtual Size

65KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text1

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

68KB

Virtual Size

65KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_Trojan-Dropper.Win32.Genome.fus.13021d8eccbc5900bc010a8ee116567d

kernel32

user32

gdi32

advapi32

shell32

ws2_32

imm32

shlwapi

version

generic