jaffacakes118_Trojan[.]Win32[.]Fsysna[.]elde[.]b6706ab96ea82ef4ac663f83f7143762

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan.Win32.Fsysna.elde.b6706ab96ea82ef4ac663f83f7143762
Size 1.2MB
Sample261010-relmjsdx9l
SHA256 dabce8271ddd16b1e0e352445b4fca48c6c8b2ef7363ebfc3a6abbf1550c2b64
MD5 b6706ab96ea82ef4ac663f83f7143762
SHA1 d347cff2d92548e34c023a0595195c4729171e5b
SHA512 688969b1931a0bf65f1930411cf9d75682f73b7982d2d7f5a7f1a89b775e7a9b9b54fe0f19ce4f7ff666f337177bf427af2833b1b9721c6fee8125808826c094
SSDEEP 24576:G+ap6AiXZuZqYstsYD3s+T9IWG4Ldp2D/Heb3FY:G+aI9ZLbT9ICcHeb+
TLSH
T1EA450240B59290B6D98A277012534AB166377C2706705A3ABFCC7B6E6F326311F3A74F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan.Win32.Fsysna.elde.b6706ab96ea82ef4ac663f83f7143762

File Explorer

jaffacakes118_Trojan.Win32.Fsysna.elde.b6706ab96ea82ef4ac663f83f7143762

.exe 1.2MB

jaffacakes118_Trojan.Win32.Fsysna.elde.b6706ab96ea82ef4ac663f83f7143762

IMPHASH b9dd7bbe125f2256ee63767b8d0dd75c
SHA256 dabce8271ddd16b1e0e352445b4fca48c6c8b2ef7363ebfc3a6abbf1550c2b64
MD5 b6706ab96ea82ef4ac663f83f7143762
SHA1 d347cff2d92548e34c023a0595195c4729171e5b
SHA512 688969b1931a0bf65f1930411cf9d75682f73b7982d2d7f5a7f1a89b775e7a9b9b54fe0f19ce4f7ff666f337177bf427af2833b1b9721c6fee8125808826c094
SSDEEP 24576:G+ap6AiXZuZqYstsYD3s+T9IWG4Ldp2D/Heb3FY:G+aI9ZLbT9ICcHeb+
TLSH
T1EA450240B59290B6D98A277012534AB166377C2706705A3ABFCC7B6E6F326311F3A74F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

65852

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\has\1973\selfish\Cabinet\stream.pdb

kernel32

MultiByteToWideChar LCMapStringW RtlUnwind QueryPerformanceCounter HeapCreate DeleteCriticalSection GetFileType InitializeCriticalSectionAndSpinCount SetHandleCount GetEnvironmentStringsW WideCharToMultiByte FreeEnvironmentStringsW GetModuleFileNameA GetModuleFileNameW GetStdHandle WriteFile ExitProcess IsProcessorFeaturePresent HeapFree GetCurrentThreadId GetStringTypeW TlsFree TlsSetValue TlsGetValue TlsAlloc IsValidCodePage GetOEMCP GetACP InterlockedDecrement InterlockedIncrement GetCPInfo GetCurrentProcess TerminateProcess SetFilePointer GetConsoleCP GetConsoleMode HeapSize HeapReAlloc FlushFileBuffers SetStdHandle WriteConsoleW CloseHandle LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetLastError GetCurrentProcessId LoadLibraryA GetTickCount EncodePointer CreateFileW IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter Sleep GetSystemTimeAsFileTime HeapAlloc GetProcAddress DecodePointer GetStartupInfoW HeapSetInformation GetCommandLineA RaiseException GetThreadLocale FormatMessageA lstrcpyA lstrcatA LoadLibraryW SetLastError GetModuleHandleW CreateIoCompletionPort

user32

MonitorFromRect MessageBoxA IsWindow ChangeDisplaySettingsA ShowCursor ReleaseDC UnregisterClassA ModifyMenuA GetWindowRect GetDC GetSystemMetrics SystemParametersInfoA PostQuitMessage DefWindowProcA DialogBoxParamA EnumWindows GetWindowThreadProcessId EndPaint DrawTextA BeginPaint DispatchMessageA PeekMessageA EnumPropsA GetForegroundWindow GetKeyboardLayoutList LoadKeyboardLayoutA SetKeyboardState ActivateKeyboardLayout keybd_event GetCursorPos GetKeyboardLayout ClipCursor GetMonitorInfoA GetFocus MonitorFromWindow GetWindow OffsetRect ClientToScreen GetClientRect GetWindowDC SetDlgItemTextA DestroyMenu CreateWindowExA InsertMenuA CreateMenu RegisterClassA LoadCursorA GetDlgItemTextA IsDlgButtonChecked GetDlgItem SetWindowTextA SendMessageA WindowFromPoint

gdi32

SetViewportOrgEx GetBoundsRect TextOutA DeleteObject GetCharABCWidthsA GetTextExtentPoint32A Ellipse CreateSolidBrush CreateCompatibleDC ExcludeClipRect CombineRgn CreateRectRgn SetTextAlign GetTextMetricsA GetStockObject SelectObject GetCharABCWidthsI

comdlg32

GetSaveFileNameA CommDlgExtendedError

advapi32

RegQueryValueExA RegCreateKeyA RegCloseKey

shell32

DragQueryFileA Shell_NotifyIconA

ole32

RegisterDragDrop

avifil32

AVIStreamSetFormat AVIStreamRelease AVIMakeCompressedStream

winmm

mmioRead mmioDescend mmioOpenA mmioStringToFOURCCA mmioClose mmioAscend

pdh

PdhBrowseCountersA

rpcrt4

NdrOleAllocate

gdiplus

GdiplusStartup

opengl32

wglDeleteContext wglMakeCurrent

imm32

ImmReleaseContext ImmGetOpenStatus ImmSetOpenStatus ImmIsIME ImmGetContext

uxtheme

DrawThemeBackground

Name

.text

Size

101KB

Virtual Size

101KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

47KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.trace

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1010KB

Virtual Size

1010KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

11KB

Virtual Size

715KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_Trojan.Win32.Fsysna.elde.b6706ab96ea82ef4ac663f83f7143762

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

avifil32

winmm

pdh

rpcrt4

gdiplus

opengl32

imm32

uxtheme

generic