jaffacakes118_HEUR[.]Trojan[.]Win32[.]Generic[.]1df7997a13164f4d598e688242683d33

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.1df7997a13164f4d598e688242683d33
Size 86KB
Sample261013-3vls2ac161
SHA256 ea6939e2182fa58806f610efa7f5761b4100162906533f7797831a47397dbf37
MD5 1df7997a13164f4d598e688242683d33
SHA1 87ac45ea7ca6443523e2d10394f491c9a9a9db23
SHA512 ef2b098657dde64e27c4b11133fc8f96b4b24ff619339c1599fe34998d4ecbb9a0b6955fbd47aeb5786a0bd6e53744d094b983d620440856ede967b86ecc1206
SSDEEP 1536:NjI61vEOPyD6FBPI38CfS/yPjh9dgT75SiRzvc7yxCHaTUkFLw1Cb+A:66FjPywBPu6/yPI7E6zvceFoSLw4b+
TLSH
T10283E0627618CECAD0A546320A37D98B43B0FD728D0CE221714B3B5D8EFF7C66E81665
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_HEUR.Trojan.Win32.Generic.1df7997a13164f4d598e688242683d33

File Explorer

jaffacakes118_HEUR.Trojan.Win32.Generic.1df7997a13164f4d598e688242683d33

.dll 86KB

jaffacakes118_HEUR.Trojan.Win32.Generic.1df7997a13164f4d598e688242683d33

IMPHASH 42afd655a352b35a2d23bab3ef1c60fe
SHA256 ea6939e2182fa58806f610efa7f5761b4100162906533f7797831a47397dbf37
MD5 1df7997a13164f4d598e688242683d33
SHA1 87ac45ea7ca6443523e2d10394f491c9a9a9db23
SHA512 ef2b098657dde64e27c4b11133fc8f96b4b24ff619339c1599fe34998d4ecbb9a0b6955fbd47aeb5786a0bd6e53744d094b983d620440856ede967b86ecc1206
SSDEEP 1536:NjI61vEOPyD6FBPI38CfS/yPjh9dgT75SiRzvc7yxCHaTUkFLw1Cb+A:66FjPywBPu6/yPI7E6zvceFoSLw4b+
TLSH
T10283E0627618CECAD0A546320A37D98B43B0FD728D0CE221714B3B5D8EFF7C66E81665
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11314

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

atl

ord16 ord18 ord57 ord23 ord15 ord58 ord32 ord30 ord43 ord44 ord21

kernel32

VirtualAlloc VirtualFree HeapAlloc GetProcessHeap HeapFree GetSystemDirectoryW Sleep lstrcpynW GetVersionExW GetComputerNameExW GetCurrentProcess FlushInstructionCache LoadLibraryA CompareStringW InterlockedExchange GetComputerNameW LocalAlloc ExpandEnvironmentStringsA CreateActCtxW ReleaseActCtx ActivateActCtx DeactivateActCtx OutputDebugStringA GetModuleFileNameW LoadLibraryW GetVersion GetFileAttributesW GetProcAddress GetModuleHandleW GetModuleHandleA ExpandEnvironmentStringsW SetLastError GetLastError EnterCriticalSection LeaveCriticalSection InterlockedCompareExchange RtlUnwind QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter GetShortPathNameW InitializeCriticalSection DeleteCriticalSection InterlockedIncrement InterlockedDecrement DisableThreadLibraryCalls LocalFree lstrlenW

advapi32

RegOpenKeyExA RegQueryValueExA RegEnumValueW RegQueryInfoKeyW RegSetValueExW RegConnectRegistryW RegOpenKeyExW RegCreateKeyW RegOpenKeyW RegQueryValueExW RegCloseKey

shell32

SHBrowseForFolderW SHGetPathFromIDListW

ole32

StringFromGUID2 CoTaskMemAlloc CoInitializeEx CoCreateInstanceEx CoUninitialize CoCreateGuid CoSetProxyBlanket CoTaskMemFree

oleaut32

SysAllocStringByteLen SysAllocString LoadRegTypeLi SysStringLen SysFreeString SysStringByteLen

netapi32

NetUseAdd NetUseDel

ntdll

RtlQueryEnvironmentVariable_U RtlSetEnvironmentVariable RtlInitUnicodeString RtlExpandEnvironmentStrings_U RtlDestroyEnvironment RtlCreateEnvironment

Name

.text

Size

59KB

Virtual Size

92KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

124KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.edata

Size

512B

Virtual Size

165B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

260B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_HEUR.Trojan.Win32.Generic.1df7997a13164f4d598e688242683d33

atl

kernel32

advapi32

shell32

ole32

oleaut32

netapi32

ntdll

generic