jaffacakes118_Virus[.]Win32[.]Virut[.]ce[.]c61a58d7ce1ab870742d0

General

Target
jaffacakes118_Virus.Win32.Virut.ce.c61a58d7ce1ab870742d0
Size 740KB
Sample261012-1cd95afv3v
SHA256 09a541f7590ff56e4926713fce8cf112e2cd6eab1aa704e3876bb34e1c0a6f1b
MD5 503216726cbc61a58d7ce1ab870742d0
SHA1 bbeed5c3bd91b7907589c1a7aab65588b521ef91
SHA512 5c937ed299b467f3b387bb0dd35ddceb159309f4f54ea79c662a6de694ad44fcd3ab68639f1f38727bb60ff795e7ce7af0686fac26150086011ac8c6f7961a50
SSDEEP 3072:xnnAQVG/LytaKItS/fiLKS+f5Aq7i08haDxWclTeCeGmGhDa0OY4LgG9htQrz0Am:ZOTeHI8HiL7+f53s8xWZTGhDZBJZ7nU
TLSH
T13CF4CF51B3A540B2D869197304334B71AB7E7C626BB6C78F678479BE7E302909E32317
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Virus.Win32.Virut.ce.c61a58d7ce1ab870742d0

File Explorer

jaffacakes118_Virus.Win32.Virut.ce.c61a58d7ce1ab870742d0

.exe 740KB

jaffacakes118_Virus.Win32.Virut.ce.c61a58d7ce1ab870742d0

IMPHASH 2cf2a9e0f8c6a675c5f2e30fd0e214f6
SHA256 09a541f7590ff56e4926713fce8cf112e2cd6eab1aa704e3876bb34e1c0a6f1b
MD5 503216726cbc61a58d7ce1ab870742d0
SHA1 bbeed5c3bd91b7907589c1a7aab65588b521ef91
SHA512 5c937ed299b467f3b387bb0dd35ddceb159309f4f54ea79c662a6de694ad44fcd3ab68639f1f38727bb60ff795e7ce7af0686fac26150086011ac8c6f7961a50
SSDEEP 3072:xnnAQVG/LytaKItS/fiLKS+f5Aq7i08haDxWclTeCeGmGhDa0OY4LgG9htQrz0Am:ZOTeHI8HiL7+f53s8xWZTGhDZBJZ7nU
TLSH
T13CF4CF51B3A540B2D869197304334B71AB7E7C626BB6C78F678479BE7E302909E32317
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

243185

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

ws2_32

getpeername recv socket ioctlsocket select closesocket recvfrom inet_ntoa htons htonl inet_addr sendto send gethostbyname __WSAFDIsSet connect WSAStartup

kernel32

WriteProcessMemory GetProcAddress LoadLibraryA ReadProcessMemory GetCurrentProcess GetModuleHandleA ReadFile CreateDirectoryA DeleteFileA GetFileAttributesA SetEndOfFile SetFilePointer FindFirstFileA GetDriveTypeA GetLogicalDrives lstrcpynA WideCharToMultiByte MultiByteToWideChar GetLastError Process32Next Process32First CreateToolhelp32Snapshot FlushViewOfFile UnmapViewOfFile GetVersionExA GetSystemDirectoryA GetWindowsDirectoryA GetModuleFileNameA CreateThread Sleep SetFileAttributesA CreateFileA GetFileSize CreateFileMappingA MapViewOfFile WriteFile CloseHandle FindNextFileA HeapSize HeapReAlloc VirtualAlloc InitializeCriticalSectionAndSpinCount GetLocaleInfoA EnterCriticalSection GetCommandLineA GetStartupInfoA RtlUnwind TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId ExitProcess GetStdHandle FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType DeleteCriticalSection HeapCreate VirtualFree HeapFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime HeapAlloc RaiseException LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW LeaveCriticalSection

advapi32

RegDeleteKeyA QueryServiceConfigA ChangeServiceConfigA StartServiceA CreateServiceA OpenServiceA QueryServiceStatus SetServiceStatus RegCreateKeyA RegOpenKeyA RegQueryValueExA RegCreateKeyExA RegSetValueExA RegCloseKey OpenSCManagerA StartServiceCtrlDispatcherA RegisterServiceCtrlHandlerA

shell32

ShellExecuteA

Name

.text

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

87KB

Virtual Size

86KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

204KB

Virtual Size

204KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

430KB

Virtual Size

432KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_Virus.Win32.Virut.ce.c61a58d7ce1ab870742d0

ws2_32

kernel32

advapi32

shell32

generic