jaffacakes118_HEUR[.]Trojan[.]Win32[.]Generic[.]0736b1127365d8d688c18a1965b07751

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.0736b1127365d8d688c18a1965b07751
Size 52KB
Sample261013-1rpdmstybx
SHA256 49102d46fa8eeb26806ff029066789ddb7ddf082fa4d55be3b65942975f5c09c
MD5 0736b1127365d8d688c18a1965b07751
SHA1 3f6bbd7c8247244a4ac8b471e71347b304e21da8
SHA512 54e44394201a2b47f787429097aac58aa9a4b634bce04553106a0ccd8ea408fe58f776afdddc62e1c0442ea9515edd2fb67365e3d955ef2f339c7ff6a211ec56
SSDEEP 768:Pp7NnEaYY5KlrBaP1MHfMQocdIt8tZenWpf+yb1I4zVZ5tHn0ZPUWz0IUUiM95Z:PpOa/2oMRO+WWdNbrVZ70ZCIVJ9
TLSH
T1B7338C837AC0EC92C5218DB0257F177ACF77FD354D64850B8B10BE5D2E36E9294A22AD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_HEUR.Trojan.Win32.Generic.0736b1127365d8d688c18a1965b07751

File Explorer

jaffacakes118_HEUR.Trojan.Win32.Generic.0736b1127365d8d688c18a1965b07751

.exe 52KB

jaffacakes118_HEUR.Trojan.Win32.Generic.0736b1127365d8d688c18a1965b07751

IMPHASH 331d50fb310b932ad06c48cd212e15ec
SHA256 49102d46fa8eeb26806ff029066789ddb7ddf082fa4d55be3b65942975f5c09c
MD5 0736b1127365d8d688c18a1965b07751
SHA1 3f6bbd7c8247244a4ac8b471e71347b304e21da8
SHA512 54e44394201a2b47f787429097aac58aa9a4b634bce04553106a0ccd8ea408fe58f776afdddc62e1c0442ea9515edd2fb67365e3d955ef2f339c7ff6a211ec56
SSDEEP 768:Pp7NnEaYY5KlrBaP1MHfMQocdIt8tZenWpf+yb1I4zVZ5tHn0ZPUWz0IUUiM95Z:PpOa/2oMRO+WWdNbrVZ70ZCIVJ9
TLSH
T1B7338C837AC0EC92C5218DB0257F177ACF77FD354D64850B8B10BE5D2E36E9294A22AD
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

21942

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

wsock32

send WSACleanup closesocket connect socket htons gethostbyname shutdown recv WSAStartup select WSAGetLastError

psapi

GetProcessMemoryInfo

mfc42

ord5290 ord3136 ord3402 ord4424 ord5265 ord4376 ord4853 ord4998 ord2514 ord6052 ord4078 ord1775 ord4407 ord5241 ord2385 ord5163 ord6374 ord4353 ord5280 ord3798 ord4837 ord4441 ord2648 ord2055 ord6376 ord3749 ord5065 ord1727 ord5261 ord2446 ord2124 ord5277 ord2982 ord3147 ord3259 ord4465 ord3262 ord2985 ord3081 ord2976 ord3830 ord3831 ord3825 ord3079 ord4080 ord4627 ord4425 ord3597 ord567 ord540 ord324 ord2135 ord825 ord641 ord800 ord818 ord2302 ord4234 ord4710 ord2764 ord1776 ord2688 ord1601 ord939 ord858 ord922 ord6663 ord539 ord4673 ord4274 ord6375 ord4486 ord2554 ord2512 ord5731 ord3922 ord1089 ord5199 ord2396 ord3346 ord5300 ord5302 ord2725 ord4079 ord4698 ord5307 ord5289 ord5714 ord4622 ord3738 ord561 ord815 ord823 ord2621 ord1134 ord1576 ord1232 ord1168 ord2864 ord6215 ord2086 ord1105 ord535 ord860 ord5710 ord4278 ord2763 ord4129 ord4287 ord2379 ord941 ord940 ord536 ord6199 ord3092 ord2818 ord6662 ord4202 ord3874 ord668 ord1980 ord3181 ord4058 ord2781 ord2770 ord356 ord6877 ord924 ord665 ord3790 ord354 ord926 ord1949 ord4034 ord6055 ord861 ord537

msvcrt

memcpy rand fopen atoi srand time _mbscmp _i64toa atol memset fclose fwrite strcpy fread strcat __dllonexit _onexit _exit _XcptFilter _acmdln __getmainargs _initterm __setusermatherr _adjust_fdiv __p__commode __p__fmode __set_app_type _except_handler3 _controlfp exit _setmbcp _mkdir

kernel32

CreateProcessA GetStartupInfoA GetModuleHandleA CreateThread GetWindowsDirectoryA CopyFileA MultiByteToWideChar WinExec DeleteFileA CloseHandle SetFileAttributesA GetCurrentProcessId OpenProcess TerminateProcess Sleep GetModuleFileNameA

user32

FindWindowA GetCursorPos EnumWindows GetClassNameA SendMessageA PostMessageA SetTimer KillTimer EnableWindow GetClassInfoA GetWindow

shell32

ShellExecuteA SHGetSpecialFolderPathA

ole32

CoCreateInstance CoInitialize