jaffacakes118_HEUR[.]Trojan[.]Win32[.]Generic[.]0ffbc44f49ba38dad8ffaadde7241490

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.0ffbc44f49ba38dad8ffaadde7241490
Size 274KB
Sample261013-2srqtsdf42
SHA256 371a9fae60d800d1967afd9d5019294e6b3e55491d039453aa28a544f5bb7da4
MD5 0ffbc44f49ba38dad8ffaadde7241490
SHA1 2c70d2e8dac793cd75a09bc1706949e1835b59e1
SHA512 f5a80992931fa714557df0d10fa8504016fa76d94609b1fe9c2389b53a0288ba14f8696f1c97e2c890d818c464c6f0848e6d3acf6a8e79e2fe3a90dc34bd08b7
SSDEEP 3072:tvI01JiZZBsQA2PKNYMu2f3Yn0B90tQRJibCFNDHDqmlGADUOn1o05:FNJiZZ2QrPKNYMlfdItQwy5DqmlPwso
TLSH
T170546B027BC0C032D15629B10D1BCBF59A7AB825A7666BDBBBD40A384F346D1FA3570D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_HEUR.Trojan.Win32.Generic.0ffbc44f49ba38dad8ffaadde7241490

File Explorer

jaffacakes118_HEUR.Trojan.Win32.Generic.0ffbc44f49ba38dad8ffaadde7241490

.exe 274KB

jaffacakes118_HEUR.Trojan.Win32.Generic.0ffbc44f49ba38dad8ffaadde7241490

IMPHASH 3766e2e5f885383fa6dd4ef480ef2755
SHA256 371a9fae60d800d1967afd9d5019294e6b3e55491d039453aa28a544f5bb7da4
MD5 0ffbc44f49ba38dad8ffaadde7241490
SHA1 2c70d2e8dac793cd75a09bc1706949e1835b59e1
SHA512 f5a80992931fa714557df0d10fa8504016fa76d94609b1fe9c2389b53a0288ba14f8696f1c97e2c890d818c464c6f0848e6d3acf6a8e79e2fe3a90dc34bd08b7
SSDEEP 3072:tvI01JiZZBsQA2PKNYMu2f3Yn0B90tQRJibCFNDHDqmlGADUOn1o05:FNJiZZ2QrPKNYMlfdItQwy5DqmlPwso
TLSH
T170546B027BC0C032D15629B10D1BCBF59A7AB825A7666BDBBBD40A384F346D1FA3570D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

63226

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

N:\down2.winsoft1.com\setup\p002_cm1\setup.pdb

shell32

ShellExecuteA

ole32

CoInitialize

oleaut32

SysFreeString

kernel32

CloseHandle TerminateThread WaitForSingleObject CreateThread ExpandEnvironmentStringsA lstrlenA lstrcatA lstrcpyA SetLastError GetLastError CreateRemoteThread GetProcAddress GetExitCodeProcess GetFileAttributesExA GetCurrentProcess GetModuleHandleA CreateMutexA MoveFileA RemoveDirectoryA DeleteFileA CreateDirectoryA GetTempPathA GetCommandLineA GetModuleFileNameA Sleep GetLocalTime GetTickCount WriteFile GetProcessHeap ReadFile GetLocaleInfoW CompareStringA CompareStringW DuplicateHandle RaiseException SetEndOfFile GetTimeZoneInformation LoadLibraryA InterlockedExchange FreeLibrary SetConsoleCtrlHandler InitializeCriticalSectionAndSpinCount CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA FlushFileBuffers SetStdHandle IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetDateFormatA GetTimeFormatA GetStringTypeW GetStringTypeA SetFilePointer RtlUnwind TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent SetEnvironmentVariableA GetStartupInfoA HeapFree HeapAlloc GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement GetCurrentThread GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringA WideCharToMultiByte MultiByteToWideChar LCMapStringW EnterCriticalSection LeaveCriticalSection GetConsoleCP GetConsoleMode HeapSize ExitProcess GetStdHandle FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType DeleteCriticalSection HeapCreate HeapDestroy VirtualFree QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime FatalAppExitA VirtualAlloc HeapReAlloc

advapi32

RegDeleteValueA RegCreateKeyExA RegSetValueExA RegOpenKeyExA RegQueryValueExA RegCloseKey RegOpenKeyA

user32

wsprintfA

shlwapi

PathGetArgsA PathFileExistsA PathIsDirectoryA PathRemoveBlanksA PathFindFileNameA

ws2_32

recv send gethostbyname select connect closesocket __WSAFDIsSet htons socket WSAStartup ioctlsocket

netapi32

Netbios