jaffacakes118_Trojan-Dropper[.]Win32[.]Injector[.]qgol[.]c2ad11a2fc2ac14b2108ac32de06535f

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan-Dropper.Win32.Injector.qgol.c2ad11a2fc2ac14b2108ac32de06535f
Size 315KB
Sample261009-xt4dssdt5w
SHA256 71737c42dea34afe548352a3a08e8354522b3b5867b27942213060583f31edfa
MD5 c2ad11a2fc2ac14b2108ac32de06535f
SHA1 14e7787648513de79ab1f0d076a0a0e27d8ce791
SHA512 bb3fe0ec9c39cb1893f9ad453b0d782d19dc9d58e7814e30e67d19d1cfd153651c57d9a213fa6e4a57572615d51353aa5c229172591005fc15a5a42d5c060808
SSDEEP 6144:czG6P0FJN0pGMzIh5UzCkRhAubT2Taygkbjytam2aa:czGiqAzzIvUzBRP2upkvyB2
TLSH
T161641281E2D4904FD4A1C631B4762B3BE82E0819140CCBEEE47C1656A635BFBDB52BF5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan-Dropper.Win32.Injector.qgol.c2ad11a2fc2ac14b2108ac32de06535f

File Explorer

jaffacakes118_Trojan-Dropper.Win32.Injector.qgol.c2ad11a2fc2ac14b2108ac32de06535f

.exe 315KB

jaffacakes118_Trojan-Dropper.Win32.Injector.qgol.c2ad11a2fc2ac14b2108ac32de06535f

IMPHASH d042d9e82ca16c308ce377adf73289fe
SHA256 71737c42dea34afe548352a3a08e8354522b3b5867b27942213060583f31edfa
MD5 c2ad11a2fc2ac14b2108ac32de06535f
SHA1 14e7787648513de79ab1f0d076a0a0e27d8ce791
SHA512 bb3fe0ec9c39cb1893f9ad453b0d782d19dc9d58e7814e30e67d19d1cfd153651c57d9a213fa6e4a57572615d51353aa5c229172591005fc15a5a42d5c060808
SSDEEP 6144:czG6P0FJN0pGMzIh5UzCkRhAubT2Taygkbjytam2aa:czGiqAzzIvUzBRP2upkvyB2
TLSH
T161641281E2D4904FD4A1C631B4762B3BE82E0819140CCBEEE47C1656A635BFBDB52BF5
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

319112

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

TraceMessageVa TrusteeAccessToObjectW

iphlpapi

FlushIpNetTable IpRenewAddress NotifyRouteChange GetExtendedUdpTable GetOwnerModuleFromUdp6Entry CancelIPChangeNotify GetNumberOfInterfaces Icmp6ParseReplies AllocateAndGetIpAddrTableFromStack NotifyAddrChange InternalDeleteIpNetEntry DeleteProxyArpEntry CreateIpForwardEntry GetPerAdapterInfo GetNetworkParams SetIpTTL UnenableRouter GetTcpTable RestoreMediaSense GetAdapterIndex InternalGetIfTable

kernel32

RtlCaptureContext BuildCommDCBA ActivateActCtx GetModuleHandleA GetCurrentProcessId RaiseException

ole32

CoLoadLibrary CreateAntiMoniker OleCreateLink IIDFromString OleRun CoFreeUnusedLibraries OleCreateFromFileEx OleConvertOLESTREAMToIStorage HGLOBAL_UserMarshal HBRUSH_UserFree HBITMAP_UserUnmarshal CoGetMarshalSizeMax WriteStringStream CoSetCancelObject CoIsHandlerConnected CreateILockBytesOnHGlobal OleConvertIStorageToOLESTREAMEx CoFreeUnusedLibrariesEx

rasapi32

RasGetEapUserDataW

msvcrt

__p___initenv sprintf _mbstrlen strlen strncat strcpy _XcptFilter __dllonexit _aexit_rtn _amsg_exit _c_exit _cexit _exit _onexit atexit exit __p__acmdln _acmdln __getmainargs _initterm __setusermatherr _CIacos sinh __badioinfo _wspawnvp _ultoa _loaddll _dup2 _wcslwr _wcsnicmp atol strcoll iswlower _adj_fpatan labs _beginthread _waccess cosh _mbsicmp fputwc wcsspn _mbsnbcmp raise __p___winitenv asctime _ismbbpunct atan atan2 _mbschr isupper _spawnvpe _controlfp _except_handler3 __set_app_type __p__fmode __p__commode _adjust_fdiv