jaffacakes118_HEUR[.]Trojan[.]Win32[.]Generic[.]2ef1ce0ce2371c4ef21b56dd2b4ac2a8

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.2ef1ce0ce2371c4ef21b56dd2b4ac2a8
Size 114KB
Sample261014-bdbg7aev8m
SHA256 1aeef813ecefdd4c83f61299555785a4dd0ad3ef0769c1c930431315df9f286c
MD5 2ef1ce0ce2371c4ef21b56dd2b4ac2a8
SHA1 f5f4d13beb9c7cf9b31e924c1c0dd7360053b717
SHA512 cbac9ed2fcb69df21e5c38dd34233c8d832c9e49381df6fc5e8b2512fdd6920c31061f5fa706bc823125064dca93ec7d85791bb8227b0490055603f9d0cc3933
SSDEEP 3072:1W/i6XagDoRixb8DzJLLKdAlXNhJ9e2b:z2aaoRE4K69e2b
TLSH
T158B3E15279D41131EAF6D675AAA05B33CAF1F410283ADF4B0A548FB80C9DD8BC93A357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_HEUR.Trojan.Win32.Generic.2ef1ce0ce2371c4ef21b56dd2b4ac2a8

File Explorer

jaffacakes118_HEUR.Trojan.Win32.Generic.2ef1ce0ce2371c4ef21b56dd2b4ac2a8

.exe 114KB

jaffacakes118_HEUR.Trojan.Win32.Generic.2ef1ce0ce2371c4ef21b56dd2b4ac2a8

IMPHASH 753bef5b66320ad20e075c765b1fb6f0
SHA256 1aeef813ecefdd4c83f61299555785a4dd0ad3ef0769c1c930431315df9f286c
MD5 2ef1ce0ce2371c4ef21b56dd2b4ac2a8
SHA1 f5f4d13beb9c7cf9b31e924c1c0dd7360053b717
SHA512 cbac9ed2fcb69df21e5c38dd34233c8d832c9e49381df6fc5e8b2512fdd6920c31061f5fa706bc823125064dca93ec7d85791bb8227b0490055603f9d0cc3933
SSDEEP 3072:1W/i6XagDoRixb8DzJLLKdAlXNhJ9e2b:z2aaoRE4K69e2b
TLSH
T158B3E15279D41131EAF6D675AAA05B33CAF1F410283ADF4B0A548FB80C9DD8BC93A357
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6420

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ntdll

ZwSetSecurityObject ZwQueryDirectoryFile ZwSetInformationFile wcslen ZwAllocateVirtualMemory wcscpy ZwFreeVirtualMemory sprintf RtlComputeCrc32 ZwDuplicateObject ZwDeleteKey ZwDeleteValueKey ZwQueryValueKey ZwTerminateProcess RtlGetCurrentPeb RtlPrefixUnicodeString wcscat strcmp RtlIpv4StringToAddressA ZwGetContextThread RtlExitUserThread ZwWriteVirtualMemory ZwSetContextThread ZwTerminateThread RtlNtStatusToDosError ZwOpenKey _wcsicmp wcsrchr ZwWriteFile RtlDestroyQueryDebugBuffer RtlQueryProcessDebugInformation RtlCreateQueryDebugBuffer RtlEqualUnicodeString ZwSuspendThread ZwQueryInformationThread _stricmp RtlFreeUnicodeString ZwQueryEaFile RtlDosPathNameToNtPathName_U LdrFindEntryForAddress ZwAlertThread memset RtlTimeToSecondsSince1980 ZwWaitForSingleObject ZwQuerySystemInformation ZwAdjustPrivilegesToken ZwOpenThreadTokenEx ZwImpersonateThread ZwOpenThread ZwDelayExecution ZwCreateEvent RtlRandomEx ZwQueryInformationProcess ZwQueryInformationToken ZwOpenProcessToken RtlAdjustPrivilege RtlInitUnicodeString swprintf ZwOpenEvent ZwCreateFile strrchr ZwQueryInformationFile ZwReadFile ZwQueryKey ZwResumeThread ZwLoadDriver ZwCreateSymbolicLinkObject ZwUnmapViewOfSection ZwFlushVirtualMemory RtlImageNtHeader ZwMapViewOfSection ZwCreateSection ZwFsControlFile ZwSetValueKey strlen ZwCreateKey ZwClose ZwQueryVolumeInformationFile ZwOpenFile ZwOpenProcess memcpy

kernel32

FreeLibrary InterlockedExchange RaiseException GetProcAddress CreateTimerQueueTimer DeleteTimerQueueTimer BindIoCompletionCallback CreateProcessW GetLastError CreateThread DisableThreadLibraryCalls ExitThread Sleep GetSystemTimeAsFileTime VirtualProtect LocalFree LocalAlloc ExitProcess GetTickCount GetVersion LoadLibraryA

advapi32

CloseServiceHandle MD5Update MD5Final CryptAcquireContextW CryptGenRandom CryptReleaseContext OpenServiceW ControlService OpenSCManagerW MD5Init DeleteService ChangeServiceConfigW

cabinet

ord22 ord23 ord20

ws2_32

setsockopt WSASend WSARecv WSAIoctl WSASendTo closesocket WSAGetLastError WSASocketW WSACleanup WSAStartup bind WSARecvFrom