jaffacakes118_HEUR[.]Trojan[.]Win32[.]Generic[.]15019882cba4de5c9c8889c11c9888da

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.15019882cba4de5c9c8889c11c9888da
Size 260KB
Sample261013-23gnlsdf64
SHA256 3d61955a2630422a1a9d1f73cbf81adedcf03b25fc4e03866f90e67e18d66b68
MD5 15019882cba4de5c9c8889c11c9888da
SHA1 2d8a88f2e302b93492a64f46955fc3d09542a8b3
SHA512 94894053baa57558912f4fd9b54c1592d3100924cb9caf879cdc5886b4a10282cd8b98c434e6dc6a6f67c902e250d677bc04d693642e5ca38f2fbd12b45078f9
SSDEEP 6144:9V551bjpT0iYjYtzrSFdnZq3glWEGdsVrxRnwAYM5AH:9VVHpoiVtCFWVrsJnwK5i
TLSH
T1DA44E0153A18E4A1C6B12171CD69C6FEAA99BE10CC654D07BBC0BF2F3A31646B13974E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_HEUR.Trojan.Win32.Generic.15019882cba4de5c9c8889c11c9888da

File Explorer

jaffacakes118_HEUR.Trojan.Win32.Generic.15019882cba4de5c9c8889c11c9888da

.exe 260KB

jaffacakes118_HEUR.Trojan.Win32.Generic.15019882cba4de5c9c8889c11c9888da

IMPHASH 2576f2ec2bdfe2dc98f7b893bdd6cf3c
SHA256 3d61955a2630422a1a9d1f73cbf81adedcf03b25fc4e03866f90e67e18d66b68
MD5 15019882cba4de5c9c8889c11c9888da
SHA1 2d8a88f2e302b93492a64f46955fc3d09542a8b3
SHA512 94894053baa57558912f4fd9b54c1592d3100924cb9caf879cdc5886b4a10282cd8b98c434e6dc6a6f67c902e250d677bc04d693642e5ca38f2fbd12b45078f9
SSDEEP 6144:9V551bjpT0iYjYtzrSFdnZq3glWEGdsVrxRnwAYM5AH:9VVHpoiVtCFWVrsJnwK5i
TLSH
T1DA44E0153A18E4A1C6B12171CD69C6FEAA99BE10CC654D07BBC0BF2F3A31646B13974E
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

26868

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

dpwsockx.pdb

user32

PeekMessageW CloseDesktop OpenDesktopW KillTimer MsgWaitForMultipleObjects SetTimer SetThreadDesktop CharPrevW DialogBoxParamW EndDialog SetDlgItemTextW CloseWindowStation GetProcessWindowStation OpenWindowStationW SetProcessWindowStation GetDesktopWindow GetWindowRect GetClientRect MapWindowPoints SetWindowPos wsprintfA GetThreadDesktop TranslateMessage DispatchMessageW wsprintfW MessageBoxW LoadStringW CharNextW

kernel32

DuplicateHandle InterlockedExchange SetThreadPriority InterlockedExchangeAdd OpenEventW DeleteTimerQueueTimer CreateTimerQueueTimer LocalAlloc PulseEvent WideCharToMultiByte lstrcpyA QueryPerformanceFrequency GetThreadPriority GetComputerNameW InitializeCriticalSectionAndSpinCount ReleaseMutex MoveFileW GetLocalTime QueueUserWorkItem CreateMutexW GetComputerNameExW FindFirstFileW GlobalLock GlobalAlloc GlobalFree GlobalMemoryStatusEx GetSystemWindowsDirectoryW GetDiskFreeSpaceExW GetVolumeInformationW DeviceIoControl MapViewOfFile CreateFileMappingA OpenFileMappingA UnmapViewOfFile FindNextFileW FindClose RemoveDirectoryW GetVersionExW GetSystemInfo GetFileAttributesW GetTempPathW GetTempFileNameW DeleteFileW CreateDirectoryW WriteFile MoveFileExW VirtualAlloc GetFileSize ReadFile VirtualFree lstrcmpW CreateProcessW IsBadWritePtr Sleep CreateThread SetEvent TerminateThread WaitForSingleObject OutputDebugStringA LoadLibraryA ResetEvent CreateIoCompletionPort IsDebuggerPresent GetThreadLocale VirtualQueryEx GetModuleFileNameA lstrcatA lstrcmpA CreateEventA CreateSemaphoreA GetVersionExA GetModuleHandleA GetWindowsDirectoryW GetThreadContext GetExitCodeProcess SetFileAttributesW LockResource FreeLibraryAndExitThread ReleaseSemaphore CreateSemaphoreW SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter GetSystemDirectoryW LoadLibraryExW FindResourceW LoadResource SizeofResource lstrlenA TlsAlloc DisableThreadLibraryCalls TlsFree GetModuleHandleW GetShortPathNameW ExpandEnvironmentStringsW GetProcAddress OpenProcess CreateFileW ExitProcess CloseHandle FreeLibrary WaitForMultipleObjects GetCurrentThread TlsGetValue TlsSetValue DebugBreak CreateEventW LoadLibraryW GetModuleFileNameW lstrcatW HeapDestroy lstrcpynW lstrcmpiW InterlockedDecrement InterlockedIncrement DeleteCriticalSection InitializeCriticalSection LeaveCriticalSection EnterCriticalSection lstrcpyW lstrlenW MultiByteToWideChar GetLastError InterlockedCompareExchange PostQueuedCompletionStatus OutputDebugStringW SetFilePointer FormatMessageW GetQueuedCompletionStatus LocalFree GlobalUnlock

ole32

CoReactivateObject CoDisconnectObject StringFromIID StringFromGUID2 CoGetCallContext CLSIDFromProgID ProgIDFromCLSID CoFreeUnusedLibraries CLSIDFromString CoInitializeEx CoUninitialize CoGetApartmentID CoWaitForMultipleHandles CoGetCurrentLogicalThreadId CoMarshalInterface CoCreateGuid CoDeactivateObject CoCreateInstance CoGetObjectContext CoCreateFreeThreadedMarshaler CoTaskMemRealloc CoTaskMemFree CoTaskMemAlloc OleSaveToStream OleLoadFromStream WriteClassStm ReadClassStm GetHGlobalFromStream CreateStreamOnHGlobal CreateGenericComposite CreateAntiMoniker MonikerCommonPrefixWith MonikerRelativePathTo MkParseDisplayName CoRevertToSelf CreateBindCtx CoGetClassObject CoImpersonateClient CoSetProxyBlanket CoCreateInstanceEx CoGetMarshalSizeMax CoUnmarshalInterface IIDFromString StringFromCLSID CoReleaseMarshalData CoGetObject

advapi32

LsaQueryInformationPolicy IsValidSecurityDescriptor CryptAcquireContextW CryptGenRandom CryptReleaseContext GetLengthSid LsaOpenPolicy BuildExplicitAccessWithNameW SetEntriesInAclW SetSecurityDescriptorControl TraceEvent UnregisterTraceGuids OpenTraceW CopySid LsaFreeMemory LsaClose OpenProcessToken GetTokenInformation GetSidIdentifierAuthority GetSidSubAuthorityCount GetSidSubAuthority RegEnumKeyW RegEnumKeyExW RegQueryValueExW RegEnumValueW RegQueryInfoKeyW RegSetValueExW RegOpenKeyExW RegCreateKeyExW RegCloseKey RegDeleteValueW RegDeleteKeyW GetEffectiveRightsFromAclW GetAclInformation GetSecurityDescriptorDacl BuildTrusteeWithSidW LookupAccountSidW RevertToSelf ImpersonateSelf OpenThreadToken AccessCheck SetThreadToken CloseServiceHandle ControlService OpenServiceW OpenSCManagerW FreeSid SetKernelObjectSecurity SetSecurityDescriptorDacl AddAccessAllowedAce InitializeAcl AllocateAndInitializeSid InitializeSecurityDescriptor ProcessTrace RegOpenKeyW GetTraceLoggerHandle StartTraceW ControlTraceW CloseTrace SetTraceCallback EnableTrace RegisterTraceGuidsW DeregisterEventSource ReportEventW RegisterEventSourceW SetSecurityDescriptorOwner SetSecurityDescriptorGroup LookupAccountNameW GetAce AddAce AddAccessAllowedAceEx DeleteAce EqualSid IsValidSid CreateProcessAsUserW DuplicateTokenEx GetSecurityDescriptorLength

rpcrt4

UuidToStringA RpcStringFreeA UuidFromStringW UuidCreateSequential NdrDllGetClassObject NdrDllCanUnloadNow NdrCStdStubBuffer_Release NdrCStdStubBuffer2_Release NdrDllRegisterProxy NdrDllUnregisterProxy CStdStubBuffer_DebugServerRelease CStdStubBuffer_DebugServerQueryInterface CStdStubBuffer_CountRefs CStdStubBuffer_IsIIDSupported CStdStubBuffer_Invoke CStdStubBuffer_Disconnect CStdStubBuffer_Connect CStdStubBuffer_AddRef CStdStubBuffer_QueryInterface IUnknown_Release_Proxy IUnknown_AddRef_Proxy IUnknown_QueryInterface_Proxy NdrOleFree NdrOleAllocate NdrStubCall2 NdrStubForwardingFunction UuidCreate MesHandleFree MesEncodeDynBufferHandleCreate MesDecodeBufferHandleCreate NdrMesTypeEncode2 NdrMesTypeDecode2 RpcStringFreeW UuidToStringW

netapi32

NetUserModalsGet NetApiBufferFree

msvcrt

__dllonexit _onexit _wcsupr ?terminate@@YAXXZ _wsplitpath vswprintf wcstok _beginthreadex _adjust_fdiv _initterm _wcsicmp iswalpha _local_unwind2 wcsstr memmove _ftol _beginthread wcscmp mbstowcs wcstombs wcscpy wcsrchr wcslen wcsncpy _wcsdup swprintf _except_handler3 wcschr _wtoi __CxxFrameHandler realloc free malloc _ltow ??1type_info@@UAE@XZ _vsnprintf _CIexp _wstrdate _wstrtime _waccess _vsnwprintf _CxxThrowException wcscat time _snwprintf

ntdll

NtQuerySystemInformation RtlExtendedLargeIntegerDivide RtlDelete RtlSplay RtlInitializeCriticalSectionAndSpinCount RtlDeleteCriticalSection RtlInitializeCriticalSection RtlLargeIntegerDivide

mtxclu

MtxCluIsClusterPresent

version

VerQueryValueW