jaffacakes118_Virus[.]Win32[.]Sality[.]gen[.]b1f1e6a7b5c9ef6b663935dd25c8cc4b

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Virus.Win32.Sality.gen.b1f1e6a7b5c9ef6b663935dd25c8cc4b
Size 261KB
Sample261012-z6grnsft2x
SHA256 f995b191d2df51b29bf90beb53e735fc664c8df55a5b6f7924a52269cb2bf3b3
MD5 b1f1e6a7b5c9ef6b663935dd25c8cc4b
SHA1 2ab6201fe3191c7862dcb95df6d5d405d32fe7fa
SHA512 0374de10ea6120695e60a122e574921dc97f8c3a0f63585e6063c1d7d9f97111f9c35b96dd694cfa0435441325aeff48ff219f33b72a59b8874f08112109d22e
SSDEEP 6144:IN563OD7de1bxebYpBaRrNB2DElXGwV29wey+:YqOXdIteUGNQ6XnV29w+
TLSH
T10444BF223BD089F2D8A760B40AE6D3A6BB77FA114B6191C7B3551B5D5C313D20F3A386
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Virus.Win32.Sality.gen.b1f1e6a7b5c9ef6b663935dd25c8cc4b

File Explorer

jaffacakes118_Virus.Win32.Sality.gen.b1f1e6a7b5c9ef6b663935dd25c8cc4b

.exe 261KB

jaffacakes118_Virus.Win32.Sality.gen.b1f1e6a7b5c9ef6b663935dd25c8cc4b

IMPHASH 3bf7223ea95a581b76df2eaf18f77656
SHA256 f995b191d2df51b29bf90beb53e735fc664c8df55a5b6f7924a52269cb2bf3b3
MD5 b1f1e6a7b5c9ef6b663935dd25c8cc4b
SHA1 2ab6201fe3191c7862dcb95df6d5d405d32fe7fa
SHA512 0374de10ea6120695e60a122e574921dc97f8c3a0f63585e6063c1d7d9f97111f9c35b96dd694cfa0435441325aeff48ff219f33b72a59b8874f08112109d22e
SSDEEP 6144:IN563OD7de1bxebYpBaRrNB2DElXGwV29wey+:YqOXdIteUGNQ6XnV29w+
TLSH
T10444BF223BD089F2D8A760B40AE6D3A6BB77FA114B6191C7B3551B5D5C313D20F3A386
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

84946

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

s:\ytb\toolbar\clientie\v8\trunk\ytie\ytbbroker\release\ytbb.pdb

oleacc

AccessibleObjectFromWindow AccessibleChildren GetRoleTextW

wininet

InternetCrackUrlW

kernel32

LeaveCriticalSection GetModuleFileNameW FreeLibrary MultiByteToWideChar SizeofResource LoadResource FindResourceW LoadLibraryExW GetModuleHandleW CloseHandle WaitForSingleObject Sleep CreateThread CreateEventW GetCommandLineW ReleaseMutex WideCharToMultiByte lstrlenA FindClose FindNextFileW FindFirstFileW DeleteFileW WriteFile GetProcAddress LoadLibraryW GetVersionExW GetCurrentThreadId SetEvent LocalFree LockResource FindResourceExW LocalAlloc GetCurrentProcess CreateFileW EnterCriticalSection ReadFile GetFileSize CreateMutexW WaitForMultipleObjects GetTickCount LoadLibraryA CreateFileA GetStringTypeA GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter GetStartupInfoA GetFileType SetHandleCount GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA HeapSize RtlUnwind GetModuleFileNameA GetStdHandle ExitProcess HeapCreate HeapDestroy VirtualAlloc VirtualFree lstrcmpiW GetLastError DeleteCriticalSection InitializeCriticalSection RaiseException lstrlenW InterlockedIncrement InterlockedDecrement GetStringTypeW CreateDirectoryW LCMapStringW LCMapStringA FlushFileBuffers WriteConsoleW IsDebuggerPresent GetConsoleOutputCP WriteConsoleA SetStdHandle GetConsoleMode SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess SetLastError TlsFree TlsSetValue TlsAlloc TlsGetValue GetModuleHandleA IsValidCodePage GetOEMCP GetCPInfo GetStartupInfoW GetProcessHeap GetFileAttributesW HeapReAlloc HeapFree HeapAlloc GetVersionExA GetConsoleCP SetFilePointer InterlockedExchange GetACP GetLocaleInfoA GetThreadLocale

user32

MsgWaitForMultipleObjects CharUpperW GetWindowPlacement ShowWindow SetForegroundWindow PostThreadMessageW GetMessageW DispatchMessageW TranslateMessage FlashWindowEx CharNextW GetDesktopWindow PeekMessageW UnregisterClassA

advapi32

RegQueryValueExW GetSecurityDescriptorLength RegSetValueExA RegEnumKeyExW RegQueryInfoKeyW RegSetValueExW RegOpenKeyExW RegCreateKeyExW RegCloseKey RegDeleteValueW RegDeleteKeyW

shell32

ShellExecuteExW SHGetSpecialFolderPathW

ole32

StringFromGUID2 CoInitialize CoRegisterClassObject CoRevokeClassObject CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CoUninitialize CoCreateInstance

oleaut32

LoadTypeLi SysFreeString VariantCopy VariantClear VariantInit RegisterTypeLi UnRegisterTypeLi SysStringByteLen SysAllocStringByteLen VarUI4FromStr SysAllocStringLen SysAllocString LoadRegTypeLi SysStringLen

shlwapi

StrStrIW SHDeleteKeyW