jaffacakes118_HEUR[.]Trojan[.]Win32[.]Generic[.]0bc304b519911b72bf8cfd3b6219d8a3

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.0bc304b519911b72bf8cfd3b6219d8a3
Size 208KB
Sample261013-166aps1y2r
SHA256 eadc3951a91ab5605eb6077c29f35422cbcc0a881ee73e8803b27ddbc95a10c6
MD5 0bc304b519911b72bf8cfd3b6219d8a3
SHA1 54f5c3261231de4dfcb1c6780e805f39517a4d21
SHA512 20e1260010e60a14b024480675322cdf5c45dfb2f12dc908f9fdb07c6d40e6f05d5c6b50fcd40cc0e503a2c04530eb92b4a824b9428db24f90b48d768bef8494
SSDEEP 3072:y2CE63DIOYVn2N1g+2XniXOpCCGwJPYryi2aaRyve0KCal:gE6shnigiXeCC4hsseQ
TLSH
T186248E23F295C0B6D50716F10CFD6B7D5A7AF50447628AD3E3541E2EAE323C1AA3624E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_HEUR.Trojan.Win32.Generic.0bc304b519911b72bf8cfd3b6219d8a3

File Explorer

jaffacakes118_HEUR.Trojan.Win32.Generic.0bc304b519911b72bf8cfd3b6219d8a3

.exe 208KB

jaffacakes118_HEUR.Trojan.Win32.Generic.0bc304b519911b72bf8cfd3b6219d8a3

IMPHASH 747dec5c6a7318b5583a5cb6ba59097e
SHA256 eadc3951a91ab5605eb6077c29f35422cbcc0a881ee73e8803b27ddbc95a10c6
MD5 0bc304b519911b72bf8cfd3b6219d8a3
SHA1 54f5c3261231de4dfcb1c6780e805f39517a4d21
SHA512 20e1260010e60a14b024480675322cdf5c45dfb2f12dc908f9fdb07c6d40e6f05d5c6b50fcd40cc0e503a2c04530eb92b4a824b9428db24f90b48d768bef8494
SSDEEP 3072:y2CE63DIOYVn2N1g+2XniXOpCCGwJPYryi2aaRyve0KCal:gE6shnigiXeCC4hsseQ
TLSH
T186248E23F295C0B6D50716F10CFD6B7D5A7AF50447628AD3E3541E2EAE323C1AA3624E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

27088

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\newqq\AdWin\Release\AdWin.pdb

kernel32

ReleaseMutex FindClose FindFirstFileA SetFileTime SystemTimeToFileTime CreateFileA GetProcAddress LoadLibraryA FreeLibrary LocalFree MapViewOfFile UnmapViewOfFile ExitProcess WideCharToMultiByte lstrlenW MultiByteToWideChar MoveFileExA lstrlenA VirtualFreeEx GetExitCodeThread WaitForSingleObject CreateRemoteThread WriteProcessMemory VirtualAllocEx OpenProcess GetCurrentProcess InterlockedDecrement CloseHandle TlsAlloc DeleteCriticalSection GetFileType SetEnvironmentVariableA CompareStringW CompareStringA SetEndOfFile FlushFileBuffers SetStdHandle GetStringTypeW GetStringTypeA IsBadCodePtr InitializeCriticalSection GetCPInfo GetOEMCP IsBadWritePtr GetTimeZoneInformation InterlockedExchange DeleteFileA CopyFileA CreateMutexA GetModuleFileNameA Sleep GetSystemDirectoryA GetWindowsDirectoryA GetTempPathA GetCurrentThreadId GetLastError FormatMessageA GetVersionExA GetThreadLocale GetLocaleInfoA GetACP FindNextFileA SetFilePointer ReadFile LCMapStringW LCMapStringA HeapSize SetHandleCount HeapReAlloc GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA UnhandledExceptionFilter GetStdHandle WriteFile EnterCriticalSection LeaveCriticalSection SetUnhandledExceptionFilter VirtualFree HeapCreate HeapDestroy TlsGetValue TlsSetValue TlsFree GetModuleHandleA GetStartupInfoA GetCommandLineA RtlUnwind RaiseException GetSystemTimeAsFileTime IsBadReadPtr TerminateProcess GetFileAttributesA HeapAlloc HeapFree VirtualProtect VirtualAlloc GetSystemInfo VirtualQuery QueryPerformanceCounter GetTickCount GetCurrentProcessId SetLastError

user32

CreateWindowExA DefWindowProcA PostQuitMessage EndPaint BeginPaint MessageBoxA PostThreadMessageA PostMessageA TranslateMessage DispatchMessageA GetMessageA UpdateWindow RegisterClassExA EnumChildWindows EnumWindows GetClassNameA GetWindowThreadProcessId SetWindowTextA SystemParametersInfoA SetWindowPos FindWindowA KillTimer SetTimer ShowWindow

advapi32

RegCloseKey RegEnumKeyA RegEnumValueA RegQueryInfoKeyA OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges GetSecurityInfo SetEntriesInAclA SetSecurityInfo RegCreateKeyExA RegSetValueExA RegOpenKeyExA RegQueryValueExA

shell32

SHGetFolderPathA ShellExecuteA

ole32

CoCreateGuid CoInitializeEx CoCreateInstance

oleaut32

SysFreeString SysAllocString VariantClear GetErrorInfo VariantInit

netapi32

Netbios

wininet

HttpQueryInfoA InternetOpenUrlA InternetSetOptionA InternetCloseHandle InternetOpenA InternetReadFile

userenv

GetProfilesDirectoryA

urlmon

CreateURLMoniker