jaffacakes118_HEUR[.]Trojan[.]Win32[.]Generic[.]1967bb5d0518adc2f0759eda188c0544

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.1967bb5d0518adc2f0759eda188c0544
Size 58KB
Sample261013-3alyasvxds
SHA256 cd2fca13440bc0fe7467633f4a06c5f53e758260aae7e054c9c9f3f8a6be78f9
MD5 1967bb5d0518adc2f0759eda188c0544
SHA1 2c6e98731da196b85cad362e372e924cefdcc89b
SHA512 9ff158e146c9477705f046c17ddf86fe517b57da9679dffa80728886397b8a9dcb2f213788d6647bc4907b803eb43f52a690a6a5561a89a0144b7ea59b3c1d26
SSDEEP 768:eSD95tA1a9L2FzEO5XZd8t7mlgLoUjigvaoMvaLPzPPrHDtzk5MX78TgNJ:eSR5Aa9L2FzEO5XZ4MmtvbrXNw5vi
TLSH
T1C843C713AD318479F50883B6227A473CF9B5DF40A8B9C817EB94EDB26DE6702664E10D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_HEUR.Trojan.Win32.Generic.1967bb5d0518adc2f0759eda188c0544

File Explorer

jaffacakes118_HEUR.Trojan.Win32.Generic.1967bb5d0518adc2f0759eda188c0544

.exe 58KB

jaffacakes118_HEUR.Trojan.Win32.Generic.1967bb5d0518adc2f0759eda188c0544

IMPHASH bd20bc5fca6f0c44ea9808ceaa365bf8
SHA256 cd2fca13440bc0fe7467633f4a06c5f53e758260aae7e054c9c9f3f8a6be78f9
MD5 1967bb5d0518adc2f0759eda188c0544
SHA1 2c6e98731da196b85cad362e372e924cefdcc89b
SHA512 9ff158e146c9477705f046c17ddf86fe517b57da9679dffa80728886397b8a9dcb2f213788d6647bc4907b803eb43f52a690a6a5561a89a0144b7ea59b3c1d26
SSDEEP 768:eSD95tA1a9L2FzEO5XZd8t7mlgLoUjigvaoMvaLPzPPrHDtzk5MX78TgNJ:eSR5Aa9L2FzEO5XZ4MmtvbrXNw5vi
TLSH
T1C843C713AD318479F50883B6227A473CF9B5DF40A8B9C817EB94EDB26DE6702664E10D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

46112

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetOEMCP OpenProcess Sleep MoveFileExA GetTempPathA CreateProcessA SetProcessWorkingSetSize WaitForSingleObject GetShortPathNameA WinExec GetProcessId GetTempFileNameA GetBinaryTypeA CloseHandle RtlMoveMemory GetModuleHandleA ExitProcess HeapReAlloc HeapFree IsBadReadPtr GetTickCount FreeLibrary GetProcAddress LoadLibraryA LCMapStringA ReadFile SetFilePointer GetFileSize CreateFileA RtlFillMemory HeapAlloc GetProcessHeap GetModuleFileNameA IsDebuggerPresent DeleteFileA lstrlen CreateMutexA OpenMutexA lstrcpynA

shlwapi

PathFileExistsA PathFindFileNameA PathRemoveFileSpecA

advapi32

RegCloseKey RegQueryValueExA RegOpenKeyA CryptGetHashParam CryptDestroyHash CryptHashData CryptReleaseContext CryptCreateHash CryptAcquireContextA RegSetValueExA RegDeleteKeyA RegDeleteValueA RegCreateKeyA

user32

wvsprintfA FindWindowA PostMessageA ShowWindow WaitForInputIdle wsprintfA MessageBoxA GetWindowTextA EnumChildWindows GetAncestor GetWindowThreadProcessId EnumWindows

psapi

GetModuleFileNameExA EnumProcesses

urlmon

URLDownloadToFileA

shell32

ShellExecuteEx SHGetSpecialFolderPathA SHFileOperationA

wininet

InternetOpenA InternetCloseHandle InternetOpenUrlA InternetReadFile

iphlpapi

GetAdaptersInfo

msvcrt

_strnicmp malloc free memmove modf strchr _ftol atoi _CIfmod ??3@YAXPAX@Z strncmp strncpy rand srand tolower sprintf