jaffacakes118_HEUR[.]Trojan[.]Win32[.]Generic[.]08dcbba2424d54e81d126b604efa68bb

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.08dcbba2424d54e81d126b604efa68bb
Size 267KB
Sample261013-1vxjestyf1
SHA256 14b483385e8c90b80204aa015af6fdc6cfc376562714ac192f29732c2b4b6c8c
MD5 08dcbba2424d54e81d126b604efa68bb
SHA1 e4403f25d5cdecd148452e6ae590c84f9c0813c9
SHA512 db5b5207c36ade16ba0e266661864b784e8443930789a873da2342f7ded7d945b32df0573bcf90ba1a79e18e626db536ea43ebb04ae35caa9797bad072c3fac6
SSDEEP 3072:TGlxnBz9w8A1jwDHmcAB+F2SHp13GqlVkRm3l7Vt57deWxLX9l2QOKRs9UE+4y/R:2q5wDdCn6PlVDPuWxhh5aMyAWmOyR
TLSH
T1C244EF732699F5CCD0DA6834D826CE9D0A93782D0BCA600D59FF044EF84772E26EE55E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_HEUR.Trojan.Win32.Generic.08dcbba2424d54e81d126b604efa68bb

File Explorer

jaffacakes118_HEUR.Trojan.Win32.Generic.08dcbba2424d54e81d126b604efa68bb

.exe 267KB

jaffacakes118_HEUR.Trojan.Win32.Generic.08dcbba2424d54e81d126b604efa68bb

IMPHASH 239199da8d7b8456b323bf501b3c091d
SHA256 14b483385e8c90b80204aa015af6fdc6cfc376562714ac192f29732c2b4b6c8c
MD5 08dcbba2424d54e81d126b604efa68bb
SHA1 e4403f25d5cdecd148452e6ae590c84f9c0813c9
SHA512 db5b5207c36ade16ba0e266661864b784e8443930789a873da2342f7ded7d945b32df0573bcf90ba1a79e18e626db536ea43ebb04ae35caa9797bad072c3fac6
SSDEEP 3072:TGlxnBz9w8A1jwDHmcAB+F2SHp13GqlVkRm3l7Vt57deWxLX9l2QOKRs9UE+4y/R:2q5wDdCn6PlVDPuWxhh5aMyAWmOyR
TLSH
T1C244EF732699F5CCD0DA6834D826CE9D0A93782D0BCA600D59FF044EF84772E26EE55E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

18577

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CancelWaitableTimer HeapSize SetWaitableTimer FormatMessageW RegisterWaitForSingleObject GetCurrentThreadId RaiseException LockResource LoadResource GlobalUnlock ResetEvent FindResourceW WriteFile UnhandledExceptionFilter CreateProcessW SetUnhandledExceptionFilter QueueUserAPC WaitForMultipleObjects InitializeCriticalSectionAndSpinCount FindResourceExW HeapReAlloc LoadLibraryExW HeapDestroy GetModuleHandleW SleepEx lstrlenW TlsSetValue CreateNamedPipeW HeapFree IsDebuggerPresent DisconnectNamedPipe CreateFileW CloseHandle TerminateThread DuplicateHandle UnregisterWaitEx ConnectNamedPipe GlobalLock CancelIo CreateEventW FreeLibrary LocalAlloc SizeofResource CreateSemaphoreW DeleteCriticalSection GetSystemTimeAsFileTime HeapAlloc WaitForSingleObject EnterCriticalSection GetProcessHeap ReadFile GlobalSize LocalFree ResumeThread LeaveCriticalSection SetNamedPipeHandleState GetExitCodeThread ReleaseSemaphore lstrlenA OpenThread CreateWaitableTimerW GetOverlappedResult WaitForMultipleObjectsEx GetTimeFormatA VirtualAllocEx GetModuleHandleA

advapi32

TraceMessage GetTraceLoggerHandle RegQueryValueExW GetTraceEnableFlags ControlTraceW UnregisterTraceGuids RegOpenKeyExW OpenProcessToken RegisterTraceGuidsW GetTraceEnableLevel RegCloseKey GetTokenInformation ConvertSidToStringSidW

user32

CloseClipboard RegisterClipboardFormatW DestroyWindow CharNextW GetWindowThreadProcessId UnregisterClassW ChangeClipboardChain PostThreadMessageW IsWindow TranslateMessage DispatchMessageW GetActiveWindow PostMessageW EnumWindows DefWindowProcW GetOpenClipboardWindow IsClipboardFormatAvailable SendMessageW OpenClipboard RegisterClassExW GetClipboardData GetMessageW CreateWindowExW EmptyClipboard SetClipboardViewer

oleaut32

VariantClear

shlwapi

PathAddBackslashW

iphlpapi

GetAdaptersInfo

ole32

IIDFromString

winspool.drv

DocumentEvent GetPrinterA EXTDEVICEMODE EnumFormsW StartDocDlgA PrinterMessageBoxA AddPrinterDriverExW ClosePrinter AddPrinterW AddPrinterConnectionW SetPortA DeletePrintProcessorA DeletePrinterDataW SetPrinterDataExW

tapi3

DllUnregisterServer

Name

.RINL

Size

2KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_MEM_READ

Name

.text

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.IZRX

Size

1024B

Virtual Size

746B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bbFc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.FmeaFg

Size

1024B

Virtual Size

672B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.IKbndOu

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.urRr

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.YsLvTY

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.iHgb

Size

512B

Virtual Size

464B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xPLULCD

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rdata

Size

209KB

Virtual Size

208KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.GtQUiIX

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gIfquFO

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_HEUR.Trojan.Win32.Generic.08dcbba2424d54e81d126b604efa68bb

kernel32

advapi32

user32

oleaut32

shlwapi

iphlpapi

ole32

winspool.drv

tapi3

generic