jaffacakes118_Trojan-Dropper[.]Win32[.]TDSS[.]yvh[.]487d236bd5cdf8297e9fba567d17c4d9

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan-Dropper.Win32.TDSS.yvh.487d236bd5cdf8297e9fba567d17c4d9
Size 149KB
Sample261009-zb3ewsec59
SHA256 c6f06e426840cb7c202fbae4485ddd15a41e03c0b50a26e5d418b6a659228d45
MD5 487d236bd5cdf8297e9fba567d17c4d9
SHA1 2ee0f4499288de49a5d2454e4665495e3893e8f9
SHA512 34719f815627b399ddd33bbd8ba9fef1ae9c448324ab91758d55d8cae055b4690e8bb0e20d90ca21b9534ad1aadb1f58e8a46d62d81624f51d2cba5535596c56
SSDEEP 3072:G9NMGV5SKkHfVHdf8puY++m68h+dVvlV2ewQEOvsmFy4IpP1p0mB+:wTHkHd9f83b8sHvTHwQE0smI4M0mc
TLSH
T137E3F111AE42117EF242703DBB1996A817B3ABA115F9EDC701944C723F24F09B9BDE98
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan-Dropper.Win32.TDSS.yvh.487d236bd5cdf8297e9fba567d17c4d9

File Explorer

jaffacakes118_Trojan-Dropper.Win32.TDSS.yvh.487d236bd5cdf8297e9fba567d17c4d9

.exe 149KB

jaffacakes118_Trojan-Dropper.Win32.TDSS.yvh.487d236bd5cdf8297e9fba567d17c4d9

IMPHASH bce9745b58e27191fbfd6bb713c71d02
SHA256 c6f06e426840cb7c202fbae4485ddd15a41e03c0b50a26e5d418b6a659228d45
MD5 487d236bd5cdf8297e9fba567d17c4d9
SHA1 2ee0f4499288de49a5d2454e4665495e3893e8f9
SHA512 34719f815627b399ddd33bbd8ba9fef1ae9c448324ab91758d55d8cae055b4690e8bb0e20d90ca21b9534ad1aadb1f58e8a46d62d81624f51d2cba5535596c56
SSDEEP 3072:G9NMGV5SKkHfVHdf8puY++m68h+dVvlV2ewQEOvsmFy4IpP1p0mB+:wTHkHd9f83b8sHvTHwQE0smI4M0mc
TLSH
T137E3F111AE42117EF242703DBB1996A817B3ABA115F9EDC701944C723F24F09B9BDE98
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8237

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ntdll

wcslen _vsnprintf

shlwapi

StrTrimA PathAppendW StrDupA PathSkipRootA StrFormatByteSizeW

shell32

ord688

kernel32

GetCommModemStatus CallNamedPipeA ClearCommError SetVolumeLabelA SizeofResource GetThreadPriorityBoost GetFileSizeEx GetAtomNameA CreateEventW OpenEventW FatalAppExitA UnregisterWait FileTimeToDosDateTime lstrcpyA GetCurrentDirectoryA LoadLibraryW VirtualQuery CreatePipe SetNamedPipeHandleState GetSystemTimeAdjustment GetTickCount WaitForSingleObjectEx SetFileTime

user32

PostMessageW RemovePropW SetWindowRgn DestroyIcon GetDlgItemTextA CreateIconFromResource RedrawWindow SetCursorPos SetRect IsCharAlphaNumericW GetDC CreateMDIWindowA GetParent DialogBoxIndirectParamW GetKeyNameTextA MapDialogRect CreateAcceleratorTableW SetScrollRange DrawFocusRect TranslateMessage LockWindowUpdate DragDetect LoadMenuW EnumPropsA GetWindowTextW PeekMessageW GetWindowContextHelpId GetAltTabInfoW GetListBoxInfo GrayStringW MapWindowPoints UnregisterHotKey DispatchMessageW FindWindowW MessageBoxA GetAncestor

gdi32

EndDoc GetObjectA Rectangle CopyEnhMetaFileA SetGraphicsMode ScaleWindowExtEx CreateBitmapIndirect GetMetaRgn GetObjectType GetTextCharacterExtra GetBoundsRect GetCharacterPlacementW AnimatePalette GetViewportOrgEx SetLayout GetBitmapBits GetTextExtentPointA

advapi32

AreAnyAccessesGranted GetSidLengthRequired GetSidIdentifierAuthority CopySid

Name

.text

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.etext

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

312B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.amem

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fntdat

Size

512B

Virtual Size

452B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

127KB

Virtual Size

127KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

864B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_Trojan-Dropper.Win32.TDSS.yvh.487d236bd5cdf8297e9fba567d17c4d9

ntdll

shlwapi

shell32

kernel32

user32

gdi32

advapi32

generic