jaffacakes118_Worm[.]Win32[.]AutoRun[.]edrh[.]3f45d2dc406748653520a44cac5db0a8

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Worm.Win32.AutoRun.edrh.3f45d2dc406748653520a44cac5db0a8
Size 78KB
Sample261012-1f9kfafw2w
SHA256 610b64a2c0d0aa5d81981a9a1315d53eca89dcd2a439114874648077a79503a8
MD5 3f45d2dc406748653520a44cac5db0a8
SHA1 3ebe7389d85be8ddddd915bc5a9a05ad4f641f0c
SHA512 5aa3e6a61ad26c3c1731d89cf9b8d9735ee7704cb01c3f7607e46adfbbb43203a3326bb3b9420963e5b9940b6aa3d09bc71bcf48c6beb576fd8c2a68d1621d16
SSDEEP 768:zdICxZk/89MpVT7woQJcW/bnqC03T/yEwSndA/zJmnPi3Jnv:zTYd5QJc/vaSybs4
TLSH
T1B1734943BD8418B9E8541031006EBAF6B27BBEA51A2AF9C77F14DDB14833197B63D247
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Worm.Win32.AutoRun.edrh.3f45d2dc406748653520a44cac5db0a8

File Explorer

jaffacakes118_Worm.Win32.AutoRun.edrh.3f45d2dc406748653520a44cac5db0a8

.exe .bat 78KB

jaffacakes118_Worm.Win32.AutoRun.edrh.3f45d2dc406748653520a44cac5db0a8

IMPHASH ef2c43bbd1d69c662e975f06c2f3267c
SHA256 610b64a2c0d0aa5d81981a9a1315d53eca89dcd2a439114874648077a79503a8
MD5 3f45d2dc406748653520a44cac5db0a8
SHA1 3ebe7389d85be8ddddd915bc5a9a05ad4f641f0c
SHA512 5aa3e6a61ad26c3c1731d89cf9b8d9735ee7704cb01c3f7607e46adfbbb43203a3326bb3b9420963e5b9940b6aa3d09bc71bcf48c6beb576fd8c2a68d1621d16
SSDEEP 768:zdICxZk/89MpVT7woQJcW/bnqC03T/yEwSndA/zJmnPi3Jnv:zTYd5QJc/vaSybs4
TLSH
T1B1734943BD8418B9E8541031006EBAF6B27BBEA51A2AF9C77F14DDB14833197B63D247
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86 polyglot

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

44592

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

MultiByteToWideChar lstrlenA FindClose FindFirstFileA GetSystemDirectoryA MoveFileExA ReadFile WinExec GetTempFileNameA GetTempPathA SetFilePointer lstrcpynA CreateDirectoryA FindNextFileA ReleaseMutex WaitForSingleObject lstrcmpiA lstrcpyA lstrcmpA GetEnvironmentVariableA lstrcatA GetDiskFreeSpaceA GetModuleHandleA Sleep MoveFileA GetLocalTime GetCurrentProcess FormatMessageA GetLastError GetComputerNameA SetFileAttributesW GetSystemTime VirtualAlloc VirtualFree FileTimeToDosDateTime SetEndOfFile DosDateTimeToFileTime ExitProcess SetFileTime SystemTimeToFileTime CreateProcessA GetWindowsDirectoryA CreateMutexA CreateSemaphoreA CreateThread SizeofResource LockResource LoadResource FindResourceA DeviceIoControl HeapFree HeapAlloc GetProcessHeap GetDriveTypeA GetLogicalDrives GetLogicalDriveStringsA FileTimeToSystemTime ReleaseSemaphore OpenSemaphoreA GetFileSize CreateFileMappingA MapViewOfFile WriteFile UnmapViewOfFile CreateFileA GetFileTime CloseHandle DeleteFileA GetModuleFileNameA CopyFileA SetFileAttributesA LoadLibraryA SetCurrentDirectoryA GetProcAddress

user32

CharLowerBuffA wsprintfA DefWindowProcA SetTimer ShowWindow PostQuitMessage EndDialog KillTimer DialogBoxParamA

advapi32

InitializeAcl AddAccessAllowedAce SetSecurityDescriptorDacl SetFileSecurityA InitializeSecurityDescriptor AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken RegSaveKeyA RegOpenKeyExA RegRestoreKeyA RegCloseKey RegQueryValueExA LookupAccountNameA

shell32

SHChangeNotify

ole32

CoInitialize CoUninitialize

msvcrt

strrchr _strcmpi atol isdigit _except_handler3 memmove strchr wcslen strncmp __CxxFrameHandler atoi _strlwr strncpy _findfirst _findclose _findnext

ws2_32

gethostbyname WSAStartup WSACleanup inet_addr