jaffacakes118_Virus[.]Win32[.]Virut[.]ce[.]e009f5a8a01c48111ddf3f32bc21f0a0

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Virus.Win32.Virut.ce.e009f5a8a01c48111ddf3f32bc21f0a0
Size 62KB
Sample261012-1cldfafv51
SHA256 d4069cfc76ac810eb7d20523845b206e6abd44922a46fc315fdd1c6e9ee81ff8
MD5 e009f5a8a01c48111ddf3f32bc21f0a0
SHA1 f2c21c4f37635a70d82c7767f6ddc8eadd6346ff
SHA512 0d08a33db3b1ffbdab6466ff604517779888cfdac9e0a6b31d12acd44ff9332e2a4b2d70cdfa789f4e806f02c157e3334cdad135bb41cff835de593925ffe1d8
SSDEEP 1536:lI4Wkapb5anFjMMW7MMs0+2vIiCPGbGhSULl7+fFNlYqYPSlT6z/:lIZ5lanlMMYMMsVQI3PYULl+friqD
TLSH
T1BF53C011B284807EC0F619388AB7A7294568BE511F2093CFB19C6BDEBFB45D5E831297
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Virus.Win32.Virut.ce.e009f5a8a01c48111ddf3f32bc21f0a0

File Explorer

jaffacakes118_Virus.Win32.Virut.ce.e009f5a8a01c48111ddf3f32bc21f0a0

.exe 62KB

jaffacakes118_Virus.Win32.Virut.ce.e009f5a8a01c48111ddf3f32bc21f0a0

IMPHASH 5de0cabe853d959c3319b51c8ec562e6
SHA256 d4069cfc76ac810eb7d20523845b206e6abd44922a46fc315fdd1c6e9ee81ff8
MD5 e009f5a8a01c48111ddf3f32bc21f0a0
SHA1 f2c21c4f37635a70d82c7767f6ddc8eadd6346ff
SHA512 0d08a33db3b1ffbdab6466ff604517779888cfdac9e0a6b31d12acd44ff9332e2a4b2d70cdfa789f4e806f02c157e3334cdad135bb41cff835de593925ffe1d8
SSDEEP 1536:lI4Wkapb5anFjMMW7MMs0+2vIiCPGbGhSULl7+fFNlYqYPSlT6z/:lIZ5lanlMMYMMsVQI3PYULl+friqD
TLSH
T1BF53C011B284807EC0F619388AB7A7294568BE511F2093CFB19C6BDEBFB45D5E831297
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

16921

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

UI0Detect.pdb

advapi32

CheckTokenMembership SetServiceStatus ReportEventW RegisterEventSourceW DeregisterEventSource RegisterServiceCtrlHandlerW StartServiceCtrlDispatcherW RevertToSelf CreateProcessAsUserW ImpersonateLoggedOnUser

kernel32

CloseHandle UnmapViewOfFile DuplicateHandle GetCurrentProcess MapViewOfFile CreateFileMappingW GetProcessHeap HeapFree lstrcmpW K32GetModuleBaseNameW K32GetModuleInformation GetLastError K32EnumProcessModules CompareStringW lstrlenW CompareFileTime GetSystemTimeAsFileTime K32GetModuleFileNameExW OpenProcess GetCurrentProcessId SetLastError GetTickCount HeapSetInformation GetCurrentThreadId LocalFree FormatMessageW GetModuleHandleW CreateEventW DelayLoadFailureHook GetProcAddress FreeLibrary InterlockedCompareExchange LoadLibraryExA Sleep HeapAlloc TerminateProcess QueryPerformanceCounter GetModuleHandleA SetUnhandledExceptionFilter GetStartupInfoA InterlockedExchange UnhandledExceptionFilter

gdi32

CreateSolidBrush

user32

EnumWindows RegisterShellHookWindow SetWindowLongW RegisterWindowMessageW PostQuitMessage IsWindow DestroyWindow DefWindowProcW SetTimer GetLastInputInfo MoveWindow GetSystemMetrics KillTimer SetShellWindow SystemParametersInfoW ShowWindow GetWindowTextW RegisterClassW GetWindow UnregisterClassW DispatchMessageW GetMessageW GetUserObjectInformationW GetThreadDesktop GetProcessWindowStation LoadStringW FlashWindowEx DestroyIcon LoadIconW GetWindowRect FindWindowW SendMessageW GetWindowLongW GetClassLongW PostMessageW GetWindowThreadProcessId GetWindowInfo GetClassNameW LoadCursorW GetWindowTextLengthW SetTaskmanWindow CreateWindowExW

msvcrt

memset _vsnwprintf wcsrchr _atoi64 __getmainargs _exit _XcptFilter _ismbblead exit ?terminate@@YAXXZ _acmdln _controlfp _except_handler4_common __set_app_type __p__fmode __p__commode _initterm _cexit _amsg_exit __setusermatherr

ntdll

WinSqmIsOptedIn WinSqmSetDWORD WinSqmEndSession WinSqmStartSession WinSqmSetString WinSqmAddToAverageDWORD WinSqmAddToStream WinSqmIncrementDWORD RtlAllocateAndInitializeSid RtlFreeSid

wtsapi32

WTSUnRegisterSessionNotification WTSRegisterSessionNotification WTSDisconnectSession WTSQueryUserToken

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

winsta

WinStationGetSessionIds WinStationRevertFromServicesSession WinStationSwitchToServicesSession

shell32

SHGetFolderPathW

shlwapi

ord354