jaffacakes118_HEUR[.]Trojan[.]Win32[.]Generic[.]0dfd37ffd99b6d468a791c1660f3898e

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.0dfd37ffd99b6d468a791c1660f3898e
Size 241KB
Sample261013-2f4jvsvsf1
SHA256 50633274f149b26b0528bd4c2347bd1542097eb29302c3e7af222ff246dd8627
MD5 0dfd37ffd99b6d468a791c1660f3898e
SHA1 bd87185921933c14737be1eec32b2f0476e99b95
SHA512 13964ccbcf3a677a146a5b10915e9f28b2db7316e57364090d3839bd98ce3ce45a09a1959daf3045ec31dbfd6f249cc52df537cb0a505f47c9c867144590622f
SSDEEP 6144:FsY7cf92DU4H9nBn4hbbuVyUWYgH4Va5X3g4sVs:FSFufH1BnOPuPM4OX3gts
TLSH
T12B341261F7E4395AE0530F3626E7D1B74A6DB7831C2A870299C2085FBA52FF23D08765
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
jaffacakes118_HEUR.Trojan.Win32.Generic.0dfd37ffd99b6d468a791c1660f3898e

File Explorer

jaffacakes118_HEUR.Trojan.Win32.Generic.0dfd37ffd99b6d468a791c1660f3898e

.exe 241KB

jaffacakes118_HEUR.Trojan.Win32.Generic.0dfd37ffd99b6d468a791c1660f3898e

IMPHASH 78efd8842f682695264b0d82bc988f3a
SHA256 50633274f149b26b0528bd4c2347bd1542097eb29302c3e7af222ff246dd8627
MD5 0dfd37ffd99b6d468a791c1660f3898e
SHA1 bd87185921933c14737be1eec32b2f0476e99b95
SHA512 13964ccbcf3a677a146a5b10915e9f28b2db7316e57364090d3839bd98ce3ce45a09a1959daf3045ec31dbfd6f249cc52df537cb0a505f47c9c867144590622f
SSDEEP 6144:FsY7cf92DU4H9nBn4hbbuVyUWYgH4Va5X3g4sVs:FSFufH1BnOPuPM4OX3gts
TLSH
T12B341261F7E4395AE0530F3626E7D1B74A6DB7831C2A870299C2085FBA52FF23D08765
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

ae:c3:95:92:3a:8c:98:5b:fd:37:a5:c9:e5:a6:5b:b3:e9:af:89:4d

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Adobe Systems Incorporated,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Information Systems,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US

Chains

Jul 28, 2010

CN=Adobe Systems Incorporated,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Information Systems,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Serial Number

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

May 21, 2009 - May 20, 2019

Subject

CN=Adobe Systems Incorporated,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Information Systems,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US

Serial Number

4d:4e:dd:77:06:ef:6b:31:31:d0:0b:1c:67:91:d0:c1

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 5, 2009 - Dec 10, 2010

Minor OS version

Major OS version

Entry point

981124

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GlobalDeleteAtom LoadLibraryExA GetTempFileNameA LoadLibraryA MulDiv RaiseException SetCalendarInfoA GetProcessHeaps lstrcatA CreateMutexW HeapCreate GetShortPathNameA GetLongPathNameW EnumDateFormatsW GlobalAlloc GetLocaleInfoW GetWindowsDirectoryA GetDiskFreeSpaceW GetLogicalDrives GetDiskFreeSpaceA GetUserDefaultLangID GetThreadPriority lstrcat SetCurrentDirectoryA GlobalFindAtomW lstrcmpiA GetEnvironmentVariableA DeleteAtom MultiByteToWideChar InitializeCriticalSection OpenSemaphoreW lstrcpy GetTimeFormatW GetProcAddress GetEnvironmentVariableW IsBadStringPtrA GetTempFileNameW CreateEventW CreateSemaphoreA ReplaceFileA LoadResource GetEnvironmentStringsA GetVolumeInformationW lstrcpyn IsBadReadPtr GetCPInfo FileTimeToLocalFileTime ExpandEnvironmentStringsW GetTimeFormatA GetExitCodeThread lstrcatW GetEnvironmentStringsW LoadLibraryW

user32

MonitorFromRect TrackPopupMenuEx GetCapture DefWindowProcW WaitForInputIdle ShowCursor GetForegroundWindow GetMessageW GetMenuStringW mouse_event LoadMenuW PostQuitMessage SetForegroundWindow GetScrollPos IsMenu GetDlgItemTextA OffsetRect GetKeyboardType CreateMenu GetMessageA SetWindowRgn SetDlgItemTextA InsertMenuA EndMenu WaitMessage InsertMenuItemA LoadBitmapA LoadBitmapW GetSystemMetrics SetWindowLongW CreateAcceleratorTableA PeekMessageW LoadMenuIndirectA CheckMenuItem IsChild CreateWindowExA GetMenuInfo CharUpperW MonitorFromPoint SetCapture CreateAcceleratorTableW DialogBoxIndirectParamW PostMessageW MessageBoxW SetTimer AdjustWindowRect ActivateKeyboardLayout DestroyMenu DialogBoxParamW RemoveMenu DefWindowProcA WinHelpA GetClassInfoA GetDesktopWindow GetMenuItemInfoW SetCursorPos LoadIconA IsIconic CharPrevA PeekMessageA TrackPopupMenu wsprintfW GetSubMenu SendDlgItemMessageA SetActiveWindow SetDlgItemTextW DestroyIcon GetSysColor EndDialog CreateDialogParamA EnumClipboardFormats ShowWindow OpenClipboard GetDlgItemTextW LoadIconW DialogBoxParamA EmptyClipboard CharLowerA MoveWindow GetCaretPos MessageBeep CharPrevW GetActiveWindow GetCapture UnregisterClassA RegisterClassW LoadMenuIndirectW PostMessageA GetKeyboardLayout CreateDialogParamW wsprintfA WinHelpW AppendMenuW MessageBoxIndirectA GetMenu GetMenuStringA CharUpperA GetMenuItemRect CreateWindowExW

advapi32

LsaClose SystemFunction003 CloseCodeAuthzLevel OpenTraceW RegSaveKeyExW

shell32

StrChrA SHGetDiskFreeSpaceExA SHGetSpecialFolderLocation

oleaut32

VarR4FromUI8 SafeArrayCreateVector VariantClear DispGetIDsOfNames VarI4FromDisp VarUI2FromCy VarI2FromDec VarUI4FromDec

winmm

mmioRenameA mixerSetControlDetails waveOutGetDevCapsA midiOutLongMsg mciGetErrorStringW waveOutGetPitch midiInReset mciGetDeviceIDA waveInGetID auxOutMessage midiStreamOut mciDriverNotify waveInGetErrorTextW mciGetDeviceIDFromElementIDA midiOutOpen midiInGetErrorTextW mmioInstallIOProcA mixerGetLineControlsW midiOutCacheDrumPatches

printui

bFolderEnumPrinters RegisterPrintNotify

Name

.XQlFJn

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.TIb

Size

5KB

Virtual Size

458KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

91KB

Virtual Size

90KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

1KB

Virtual Size

389KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CW

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.bvH

Size

3KB

Virtual Size

470KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gmIeg

Size

5KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.WVRX

Size

90KB

Virtual Size

90KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

12KB

Virtual Size

277KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.px

Size

1KB

Virtual Size

149KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_HEUR.Trojan.Win32.Generic.0dfd37ffd99b6d468a791c1660f3898e

PE Signature issue

kernel32

user32

advapi32

shell32

oleaut32

winmm

printui

generic