jaffacakes118_HEUR[.]Trojan[.]Win32[.]Generic[.]17f8e99da6abf402771f3f58b9c10a97

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.17f8e99da6abf402771f3f58b9c10a97
Size 116KB
Sample261013-28tkcsst9m
SHA256 9abb7024821e65dc56acdc28320eaeef905a2e52db19fa62456f23b2ab2e94f7
MD5 17f8e99da6abf402771f3f58b9c10a97
SHA1 5b604ee65edba27995c2fc7489c4cb0f4675058f
SHA512 51393133b29559a777fb741d67c5831a3b1f48e7a7a2e750a3fe60ace9b47013555d1d12567a487c3ad209b9a3b7db924bf81faa937250438e059fede6a01e5f
SSDEEP 1536:z395XZIcLULq26TtxohYBNxTxKaelcIJCcBIkLjV5By+ULvNsWbr0OP/rEtJWAEN:7HXZI76TvhxT4LtV33klsWBPQt4AEN
TLSH
T1BDC3F02AFB41EBCFF01942701D63AED6DBA8FE319E99170D7228370E1B773456242285
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_HEUR.Trojan.Win32.Generic.17f8e99da6abf402771f3f58b9c10a97

File Explorer

jaffacakes118_HEUR.Trojan.Win32.Generic.17f8e99da6abf402771f3f58b9c10a97

.dll 116KB

jaffacakes118_HEUR.Trojan.Win32.Generic.17f8e99da6abf402771f3f58b9c10a97

IMPHASH 42afd655a352b35a2d23bab3ef1c60fe
SHA256 9abb7024821e65dc56acdc28320eaeef905a2e52db19fa62456f23b2ab2e94f7
MD5 17f8e99da6abf402771f3f58b9c10a97
SHA1 5b604ee65edba27995c2fc7489c4cb0f4675058f
SHA512 51393133b29559a777fb741d67c5831a3b1f48e7a7a2e750a3fe60ace9b47013555d1d12567a487c3ad209b9a3b7db924bf81faa937250438e059fede6a01e5f
SSDEEP 1536:z395XZIcLULq26TtxohYBNxTxKaelcIJCcBIkLjV5By+ULvNsWbr0OP/rEtJWAEN:7HXZI76TvhxT4LtV33klsWBPQt4AEN
TLSH
T1BDC3F02AFB41EBCFF01942701D63AED6DBA8FE319E99170D7228370E1B773456242285
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11384

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

atl

ord16 ord18 ord57 ord23 ord15 ord58 ord32 ord30 ord43 ord44 ord21

kernel32

VirtualAlloc VirtualFree HeapAlloc GetProcessHeap HeapFree GetSystemDirectoryW Sleep lstrcpynW GetVersionExW GetComputerNameExW GetCurrentProcess FlushInstructionCache LoadLibraryA CompareStringW InterlockedExchange GetComputerNameW LocalAlloc ExpandEnvironmentStringsA CreateActCtxW ReleaseActCtx ActivateActCtx DeactivateActCtx OutputDebugStringA GetModuleFileNameW LoadLibraryW GetVersion GetFileAttributesW GetProcAddress GetModuleHandleW GetModuleHandleA ExpandEnvironmentStringsW SetLastError GetLastError EnterCriticalSection LeaveCriticalSection InterlockedCompareExchange RtlUnwind QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter GetShortPathNameW InitializeCriticalSection DeleteCriticalSection InterlockedIncrement InterlockedDecrement DisableThreadLibraryCalls LocalFree lstrlenW

advapi32

RegOpenKeyExA RegQueryValueExA RegEnumValueW RegQueryInfoKeyW RegSetValueExW RegConnectRegistryW RegOpenKeyExW RegCreateKeyW RegOpenKeyW RegQueryValueExW RegCloseKey

shell32

SHBrowseForFolderW SHGetPathFromIDListW

ole32

StringFromGUID2 CoTaskMemAlloc CoInitializeEx CoCreateInstanceEx CoUninitialize CoCreateGuid CoSetProxyBlanket CoTaskMemFree

oleaut32

SysAllocStringByteLen SysAllocString LoadRegTypeLi SysStringLen SysFreeString SysStringByteLen

netapi32

NetUseAdd NetUseDel

ntdll

RtlQueryEnvironmentVariable_U RtlSetEnvironmentVariable RtlInitUnicodeString RtlExpandEnvironmentStrings_U RtlDestroyEnvironment RtlCreateEnvironment

Name

.text

Size

89KB

Virtual Size

160KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

192KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.edata

Size

512B

Virtual Size

165B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

216B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_HEUR.Trojan.Win32.Generic.17f8e99da6abf402771f3f58b9c10a97

atl

kernel32

advapi32

shell32

ole32

oleaut32

netapi32

ntdll

generic