jaffacakes118_HEUR[.]Trojan[.]Win32[.]Generic[.]0edbe2a6647292388c07db849ff20393

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.0edbe2a6647292388c07db849ff20393
Size 168KB
Sample261013-2lz4mac19m
SHA256 5ad9021ff527616d778e981af41677787f9a4e104089eb4642ed4df297a3140c
MD5 0edbe2a6647292388c07db849ff20393
SHA1 74c49c7c3a597713d6e9569cbb0593b3f4d80799
SHA512 1a04a827071cfc84e6a9025ffe28218c444a326b5e6b803065c3651ceed2d862cfc5ff2e85b3161d8484790d859c856aae43706a8efa4a6a3957d5646ec299f8
SSDEEP 1536:O0ebfyoblYsXaKE8Pyle8eUr2tB31xLseuSJT4fHrvy/hkf70w8DIjgZZ79VxuzU:endKKE788ex1vpYe2f7X8QgjbeMHLIy
TLSH
T1A9F37A026B1B4124D47226F0BEACBFE527D3C6B934198C426271ABDF5B60AECD38D4D5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_HEUR.Trojan.Win32.Generic.0edbe2a6647292388c07db849ff20393

File Explorer

jaffacakes118_HEUR.Trojan.Win32.Generic.0edbe2a6647292388c07db849ff20393

.exe 168KB

jaffacakes118_HEUR.Trojan.Win32.Generic.0edbe2a6647292388c07db849ff20393

IMPHASH 1aa419d87d44c867db14abac1dd51e73
SHA256 5ad9021ff527616d778e981af41677787f9a4e104089eb4642ed4df297a3140c
MD5 0edbe2a6647292388c07db849ff20393
SHA1 74c49c7c3a597713d6e9569cbb0593b3f4d80799
SHA512 1a04a827071cfc84e6a9025ffe28218c444a326b5e6b803065c3651ceed2d862cfc5ff2e85b3161d8484790d859c856aae43706a8efa4a6a3957d5646ec299f8
SSDEEP 1536:O0ebfyoblYsXaKE8Pyle8eUr2tB31xLseuSJT4fHrvy/hkf70w8DIjgZZ79VxuzU:endKKE788ex1vpYe2f7X8QgjbeMHLIy
TLSH
T1A9F37A026B1B4124D47226F0BEACBFE527D3C6B934198C426271ABDF5B60AECD38D4D5
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

20828

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

TerminateProcess WaitForSingleObject CreateProcessA FreeLibrary CreateFileA DuplicateHandle GetCurrentProcess OpenProcess WriteFile GetStartupInfoA GetModuleHandleA WideCharToMultiByte GetVersionExA GetSystemDirectoryA Sleep GetModuleFileNameA WinExec GetLastError GetFileAttributesExA SetFileTime CloseHandle LoadLibraryA GetProcAddress

user32

RegisterWindowMessageA SendMessageTimeoutA GetClassNameA PostMessageA EnumChildWindows GetWindowThreadProcessId EnumWindows DispatchMessageA GetDesktopWindow TranslateMessage GetMessageA DefWindowProcA PostQuitMessage ShowWindow CreateWindowExA RegisterClassExA

advapi32

CreateServiceA LookupAccountNameA GetUserNameA RegCloseKey RegQueryValueExA RegOpenKeyExA CloseServiceHandle OpenSCManagerA StartServiceA OpenServiceA DeleteService ConvertSidToStringSidA

shell32

SHGetSpecialFolderPathA

ole32

CoInitialize CoUninitialize

oleaut32

SysFreeString VariantClear

shlwapi

SHSetValueA SHGetValueA

msvcrt

__CxxFrameHandler _strlwr _controlfp _except_handler3 __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _acmdln exit _XcptFilter _exit time srand ??2@YAPAXI@Z ??3@YAXPAX@Z fopen fwrite fflush fclose _stricmp sprintf rand _access wcslen atoi strchr strstr

dbghelp

ImageNtHeader

Name

.text

Size

20KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

116KB

Virtual Size

113KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

ndata

Size

4KB

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

mdata

Size

4KB

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

edata

Size

4KB

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

cdata

Size

4KB

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

idata

Size

4KB

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_HEUR.Trojan.Win32.Generic.0edbe2a6647292388c07db849ff20393

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

msvcrt

dbghelp

generic