jaffacakes118_HEUR[.]Trojan[.]Win32[.]Generic[.]31be9f3136e6fb002b2154692bc8ffcb

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.31be9f3136e6fb002b2154692bc8ffcb
Size 33KB
Sample261014-blppsatw2q
SHA256 257443a1cc5a4e906c29f8bcdd38d7a803485cfd8f9ff3ff7f2e77e737d78fe7
MD5 31be9f3136e6fb002b2154692bc8ffcb
SHA1 60101e102d05a9c2ec9afce9854b0ad9eb5caf14
SHA512 a116808276a0b19aa331fe5ce5606e22c4c155dbe65be020e14a48c4c7cac20ee0ca7d0cffc5ded00aa77feb33e7c7befac3417d2c07984b1241c683b90144a0
SSDEEP 768:qXM3avsNhI2DepOVBQ46yxXG+Uz8QON/CNN/9vd:qXM3csN5apmmoXEp91
TLSH
T19CE23A876A0440F2D3DE4534F0A91F3369BDD9386891A692EBF342F56CBE045E63930A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_HEUR.Trojan.Win32.Generic.31be9f3136e6fb002b2154692bc8ffcb

File Explorer

jaffacakes118_HEUR.Trojan.Win32.Generic.31be9f3136e6fb002b2154692bc8ffcb

.dll 33KB

jaffacakes118_HEUR.Trojan.Win32.Generic.31be9f3136e6fb002b2154692bc8ffcb

IMPHASH 13bd6939f751c62d64a684fb30d27e7b
SHA256 257443a1cc5a4e906c29f8bcdd38d7a803485cfd8f9ff3ff7f2e77e737d78fe7
MD5 31be9f3136e6fb002b2154692bc8ffcb
SHA1 60101e102d05a9c2ec9afce9854b0ad9eb5caf14
SHA512 a116808276a0b19aa331fe5ce5606e22c4c155dbe65be020e14a48c4c7cac20ee0ca7d0cffc5ded00aa77feb33e7c7befac3417d2c07984b1241c683b90144a0
SSDEEP 768:qXM3avsNhI2DepOVBQ46yxXG+Uz8QON/CNN/9vd:qXM3csN5apmmoXEp91
TLSH
T19CE23A876A0440F2D3DE4534F0A91F3369BDD9386891A692EBF342F56CBE045E63930A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

27793

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetLastError CreateMutexA GetCurrentProcessId ExitProcess ResumeThread WriteProcessMemory VirtualProtectEx OpenProcess GetModuleFileNameA GetProcAddress ReadProcessMemory GetModuleHandleA DeleteFileA ReadFile GetTempPathA VirtualAlloc CreateRemoteThread VirtualAllocEx lstrlenA GetPrivateProfileStringA GlobalAlloc MultiByteToWideChar CreateProcessA GetSystemDirectoryA LoadLibraryA GetCurrentThreadId SetFilePointer InitializeCriticalSection VirtualProtect LeaveCriticalSection EnterCriticalSection Process32Next Process32First CreateToolhelp32Snapshot GlobalLock GlobalUnlock GlobalFree GetCommandLineA IsBadReadPtr TerminateThread CreateThread CreateFileA WriteFile CloseHandle Sleep GetCurrentProcess WideCharToMultiByte TerminateProcess

user32

CallNextHookEx UnhookWindowsHookEx GetWindowThreadProcessId SetWindowsHookExA FindWindowA

imagehlp

ImageLoad ImageUnload

shlwapi

PathFileExistsA

msvcrt

_strnicmp malloc _adjust_fdiv _strupr _strlwr _stricmp _initterm free wcslen strcpy sprintf strlen memcpy ??2@YAPAXI@Z strrchr memset strcat atoi ??3@YAXPAX@Z strncpy strchr strstr fclose fread fopen strcmp atol

wininet

InternetReadFile InternetCloseHandle

Sharing