jaffacakes118_HEUR[.]Trojan[.]Win32[.]Generic[.]0d8723fa43ef2fae9e35a3cdf411843b

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.0d8723fa43ef2fae9e35a3cdf411843b
Size 81KB
Sample261013-2dgmbact6s
SHA256 0bedb9e97c75e17e54dc75bbfde3c2a6dbf062b507ce84781a2817742f57545e
MD5 0d8723fa43ef2fae9e35a3cdf411843b
SHA1 6c1313a5b12d45ea261d8be54086d6f347c034bf
SHA512 0fc661b1a767764fc968f02d9d5f2d6adf5504cad8f5cd243e937a39b6cde5d9ffe263f485b343f85648540e73f0061fcf2cb1da14c915d5fb4c1c07a7208d6a
SSDEEP 1536:iWvedz8aJDI7YtMSHkRwlOX+DRkVpGGU7S6a:iWC8+DDGMk4OOFkVpFP9
TLSH
T187837D0B77298472C09B01707E857B7648BF2E741C1EA693FB61764639F14FAA42DE0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_HEUR.Trojan.Win32.Generic.0d8723fa43ef2fae9e35a3cdf411843b

File Explorer

jaffacakes118_HEUR.Trojan.Win32.Generic.0d8723fa43ef2fae9e35a3cdf411843b

.dll 81KB

jaffacakes118_HEUR.Trojan.Win32.Generic.0d8723fa43ef2fae9e35a3cdf411843b

IMPHASH 2652c40fe33ffe4d8d8e132d0e0f8018
SHA256 0bedb9e97c75e17e54dc75bbfde3c2a6dbf062b507ce84781a2817742f57545e
MD5 0d8723fa43ef2fae9e35a3cdf411843b
SHA1 6c1313a5b12d45ea261d8be54086d6f347c034bf
SHA512 0fc661b1a767764fc968f02d9d5f2d6adf5504cad8f5cd243e937a39b6cde5d9ffe263f485b343f85648540e73f0061fcf2cb1da14c915d5fb4c1c07a7208d6a
SSDEEP 1536:iWvedz8aJDI7YtMSHkRwlOX+DRkVpGGU7S6a:iWC8+DDGMk4OOFkVpFP9
TLSH
T187837D0B77298472C09B01707E857B7648BF2E741C1EA693FB61764639F14FAA42DE0B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2182971

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

WriteFile WideCharToMultiByte MultiByteToWideChar GetProcAddress FindClose FindFirstFileA VirtualFreeEx WaitForSingleObject CreateRemoteThread WriteProcessMemory VirtualAllocEx OpenProcess GetTempPathA GetWindowsDirectoryA ReleaseMutex GetLastError CreateMutexA FreeLibrary GetSystemDirectoryA SetFileAttributesA GetFileAttributesA GetModuleHandleA MoveFileExA Sleep DeleteFileA GetLocalTime ReadFile SetFilePointer ReadProcessMemory VirtualQueryEx VirtualAlloc SetThreadPriority CreateThread CopyFileA GetTickCount SetFileTime GetFileTime GetPrivateProfileStringA ExitProcess TerminateProcess GetCurrentProcess WritePrivateProfileStringA DeviceIoControl IsBadReadPtr VirtualFree lstrcmpiA SetUnhandledExceptionFilter LoadLibraryA GetModuleFileNameA CreateFileA GetFileSize Process32First Process32Next HeapAlloc GetProcessHeap VirtualProtect CreateToolhelp32Snapshot Thread32First GetCurrentProcessId OpenThread GetThreadContext SetThreadContext CloseHandle Thread32Next EnterCriticalSection LeaveCriticalSection InitializeCriticalSection FindNextFileA AddVectoredExceptionHandler

user32

PostMessageA wsprintfW GetWindowTextA IsWindowVisible GetWindowRect GetDC ReleaseDC GetWindowTextW GetForegroundWindow GetClassNameW GetWindow wsprintfA FindWindowA

gdi32

CreateDCA DeleteDC DeleteObject BitBlt SelectObject CreateCompatibleBitmap CreateCompatibleDC GetDeviceCaps

advapi32

CryptCreateHash CryptHashData CryptGetHashParam CryptDestroyHash CryptReleaseContext RegEnumValueA RegEnumKeyExA RegSetValueExA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken RegCloseKey RegQueryValueExA RegOpenKeyExA CryptAcquireContextA

msvcrt

_strcmpi strstr wcsncat wcsstr _vsnprintf strrchr exit memcmp wcstombs wcsncpy _strlwr _strupr wcslen wcscpy wcscat memset memcpy _except_handler3 strcat strlen _itoa _stricmp isprint free malloc sprintf strncpy isspace isalnum atoi strchr strcpy ??3@YAXPAX@Z wcscmp ??2@YAPAXI@Z mbstowcs

wsock32

shutdown closesocket

gdiplus

GdiplusStartup GdipCreateBitmapFromHBITMAP GdipDisposeImage GdiplusShutdown GdipGetImageEncodersSize GdipGetImageEncoders GdipSaveImageToFile