jaffacakes118_Virus[.]Win32[.]Nimnul[.]a[.]a49bd3025bf06034a17524565d8031fe

General

Target
jaffacakes118_Virus.Win32.Nimnul.a.a49bd3025bf06034a17524565d8031fe
Size 99KB
Sample261012-zrmpdaef76
SHA256 5e21c28306ec4c788ff8be803779f5fe9cd22e7c0ded377cdf3aeb717e868dc4
MD5 a49bd3025bf06034a17524565d8031fe
SHA1 b0bacd48d5a226c46326a17d48015494581364e0
SHA512 e6e7757f77312decd0bed5753e50e192e57e5bc6afe5972e88d84ef0f6ac8603e1291da8d62bad0de4421fd44105dd9de7589f11a0020533332057d458af1ef5
SSDEEP 1536:ZqzT9Tj0Oe4+ZRCZAXVQvNlr9+V1qEVEp61cRzPxZHQ5PNiiWYeH+:AzhTjvGcZAXVQvE/QectPxZaNiSO+
TLSH
T155A39E649B0C8957D4A87EB8770776A8E3F4C43638275C9B3CA4295CA0F6F1F6B121E4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Virus.Win32.Nimnul.a.a49bd3025bf06034a17524565d8031fe

File Explorer

jaffacakes118_Virus.Win32.Nimnul.a.a49bd3025bf06034a17524565d8031fe

.dll 99KB

jaffacakes118_Virus.Win32.Nimnul.a.a49bd3025bf06034a17524565d8031fe

IMPHASH 0409b5c169051adccf5c209f7688412a
SHA256 5e21c28306ec4c788ff8be803779f5fe9cd22e7c0ded377cdf3aeb717e868dc4
MD5 a49bd3025bf06034a17524565d8031fe
SHA1 b0bacd48d5a226c46326a17d48015494581364e0
SHA512 e6e7757f77312decd0bed5753e50e192e57e5bc6afe5972e88d84ef0f6ac8603e1291da8d62bad0de4421fd44105dd9de7589f11a0020533332057d458af1ef5
SSDEEP 1536:ZqzT9Tj0Oe4+ZRCZAXVQvNlr9+V1qEVEp61cRzPxZHQ5PNiiWYeH+:AzhTjvGcZAXVQvE/QectPxZaNiSO+
TLSH
T155A39E649B0C8957D4A87EB8770776A8E3F4C43638275C9B3CA4295CA0F6F1F6B121E4
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

53248

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\Documents and Settings\Graha Net\Desktop\anti----PKL\Release\Anti Renames.pdb

kernel32

GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess InterlockedCompareExchange InterlockedExchange CreateThread ExitProcess Sleep GetModuleHandleA ReadProcessMemory IsBadWritePtr VirtualAlloc MulDiv VirtualProtect GetCurrentProcess IsDebuggerPresent GetSystemTimeAsFileTime

user32

GetAsyncKeyState MessageBeep RegisterClassExA GetDesktopWindow CreateWindowExA DestroyWindow DefWindowProcA GetSystemMetrics

gdi32

CreateDIBSection SetMapMode GetDeviceCaps CreateFontA SelectObject SetTextColor SetBkColor SetTextAlign GetTextExtentPoint32A ExtTextOutA DeleteObject DeleteDC CreateCompatibleDC

msvcr90

free memmove ??2@YAPAXI@Z memset _unlock __dllonexit _encode_pointer _lock _onexit _decode_pointer malloc _encoded_null _initterm _initterm_e _amsg_exit _adjust_fdiv __CppXcptFilter _crt_debugger_hook _except_handler4_common __clean_type_info_names_internal _mbsnbcpy _malloc_crt memcpy ceil

msvcp90

??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@XZ ??_D?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ

d3d9

Direct3DCreate9

Name

_TEXT

Size

512B

Virtual Size

431B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text

Size

27KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

688B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.text

Size

63KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_Virus.Win32.Nimnul.a.a49bd3025bf06034a17524565d8031fe

kernel32

user32

gdi32

msvcr90

msvcp90

d3d9

generic