jaffacakes118_HEUR[.]Trojan[.]Win32[.]Generic[.]18e12e0e1821159fbe0a6330f884f649

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.18e12e0e1821159fbe0a6330f884f649
Size 128KB
Sample261013-29dwasdf79
SHA256 cda457baa1b4c5ec09fbb8841e7fa200f4199444867f87d84d55ceabeed69fac
MD5 18e12e0e1821159fbe0a6330f884f649
SHA1 3cd1639856a13b0e7d7cc229f938e744838922dd
SHA512 0d62996ec1d9e926ec7d448b762d6564ab529d1c943c47cd0a9ad30ace6f60b3a736f3bcc9773ef02108480d9573568c2889a48d5d98452b67429f02e47ce8b5
SSDEEP 3072:GUbogt0JpEgzFBquFwXuDyM1utP2jCxhTmSl0hHOL5PFn0wcccccccc:5b9G7B7FDgQCxVmiOH0PFn0wcccccccc
TLSH
T197D3CF5122C7C4B7CE898975F89763F8AF74BDA5DD728213D6B67E6AB836020CDC2044
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_HEUR.Trojan.Win32.Generic.18e12e0e1821159fbe0a6330f884f649

File Explorer

jaffacakes118_HEUR.Trojan.Win32.Generic.18e12e0e1821159fbe0a6330f884f649

.dll 128KB

jaffacakes118_HEUR.Trojan.Win32.Generic.18e12e0e1821159fbe0a6330f884f649

IMPHASH 5ac28fc69c9f02e9177ee65f3c9c82fb
SHA256 cda457baa1b4c5ec09fbb8841e7fa200f4199444867f87d84d55ceabeed69fac
MD5 18e12e0e1821159fbe0a6330f884f649
SHA1 3cd1639856a13b0e7d7cc229f938e744838922dd
SHA512 0d62996ec1d9e926ec7d448b762d6564ab529d1c943c47cd0a9ad30ace6f60b3a736f3bcc9773ef02108480d9573568c2889a48d5d98452b67429f02e47ce8b5
SSDEEP 3072:GUbogt0JpEgzFBquFwXuDyM1utP2jCxhTmSl0hHOL5PFn0wcccccccc:5b9G7B7FDgQCxVmiOH0PFn0wcccccccc
TLSH
T197D3CF5122C7C4B7CE898975F89763F8AF74BDA5DD728213D6B67E6AB836020CDC2044
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

11138

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

DisableThreadLibraryCalls ExitProcess FindResourceA GetACP GetCommandLineA GetModuleHandleA GetOEMCP GetStartupInfoA GetSystemDirectoryA GetVersionExA HeapAlloc SetLastError SetUnhandledExceptionFilter TlsGetValue VirtualAlloc VirtualFree lstrcmpiA lstrcpyA lstrcpynA lstrlenA

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

ntdll

RtlLockHeap RtlNtStatusToDosError RtlOpenCurrentUser RtlUnlockHeap strstr NtEnumerateKey NtEnumerateValueKey NtMakeTemporaryObject NtOpenThreadToken RtlCreateSecurityDescriptor RtlExpandEnvironmentStrings_U RtlInitString RtlInitUnicodeString RtlLeaveCriticalSection RtlInitializeCriticalSection

rpcrt4

char_array_from_ndr data_into_ndr UuidIsNil short_from_ndr_temp tree_peek_ndr RpcSsEnableAllocate RpcSmSetThreadHandle RpcSmGetThreadHandle RpcSmDestroyClientContext RpcServerUseAllProtseqs RpcServerTestCancel RpcServerRegisterAuthInfoA RpcBindingSetAuthInfoA MesDecodeIncrementalHandleCreate enum_from_ndr

crtdll

wcstombs wcstok vfwprintf raise isxdigit isprint gmtime fwrite _ungetch _isctype _isatty _getdllprocaddr _copysign

Sharing