jaffacakes118_HEUR[.]Trojan[.]Win32[.]Generic[.]49d3562793fa6f740d33f4956d017ba7

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.49d3562793fa6f740d33f4956d017ba7
Size 265KB
Sample261014-c4eg7sfs2r
SHA256 6d5c5f755385e31c7d92400226c041a89a87f857ab15d567dcc5fda268e7306b
MD5 49d3562793fa6f740d33f4956d017ba7
SHA1 7c263256cbd16c232c7d17b3d02c9c16ae4329d9
SHA512 a6fd0a9eeb2288af888e4224a1a141d19f86ef626830b7b8d0ed9de82bb473b4f6a2d41fb9c4286fcb384d37a127dfef7261d46ee5f60efdc93e07b29ff31e67
SSDEEP 6144:pP7UQkSWtQfz8GJeFQhpiMam52wJgnVYDxQz+6r:pTUQkSdfzJJgQhpiMpUVGQN
TLSH
T11F44DF05AE87C0DDD034D1FAB5A7D50B00FAEAB31DA53428A7C8AFB72B14E948C5B754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_HEUR.Trojan.Win32.Generic.49d3562793fa6f740d33f4956d017ba7

File Explorer

jaffacakes118_HEUR.Trojan.Win32.Generic.49d3562793fa6f740d33f4956d017ba7

.exe 265KB

jaffacakes118_HEUR.Trojan.Win32.Generic.49d3562793fa6f740d33f4956d017ba7

IMPHASH d1fb0c96445bb1be3a65f6c84b3b0fea
SHA256 6d5c5f755385e31c7d92400226c041a89a87f857ab15d567dcc5fda268e7306b
MD5 49d3562793fa6f740d33f4956d017ba7
SHA1 7c263256cbd16c232c7d17b3d02c9c16ae4329d9
SHA512 a6fd0a9eeb2288af888e4224a1a141d19f86ef626830b7b8d0ed9de82bb473b4f6a2d41fb9c4286fcb384d37a127dfef7261d46ee5f60efdc93e07b29ff31e67
SSDEEP 6144:pP7UQkSWtQfz8GJeFQhpiMam52wJgnVYDxQz+6r:pTUQkSdfzJJgQhpiMpUVGQN
TLSH
T11F44DF05AE87C0DDD034D1FAB5A7D50B00FAEAB31DA53428A7C8AFB72B14E948C5B754
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

88705

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

userenv

UnloadUserProfile

advapi32

IsValidSid CopySid OpenThreadToken LookupAccountSidW EqualSid GetLengthSid ConvertStringSidToSidW GetTokenInformation OpenProcessToken

kernel32

HeapAlloc GetACP HeapSize IsDebuggerPresent UnhandledExceptionFilter HeapFree SizeofResource SetUnhandledExceptionFilter EnterCriticalSection lstrlenW FormatMessageW FindResourceW LockResource GetSystemTimeAsFileTime HeapDestroy LeaveCriticalSection DeleteCriticalSection GetCurrentThreadId GetProcessHeap CloseHandle FindResourceExW RaiseException LoadResource SetThreadLocale GetThreadLocale HeapReAlloc LocalAlloc VirtualAllocEx GetModuleHandleW

ole32

CoImpersonateClient CoCreateInstance CoRevertToSelf

user32

UnregisterClassA wsprintfW

oleaut32

SafeArrayUnlock SysStringLen VarBstrCat SafeArrayLock SafeArrayGetUBound SafeArrayCopy LoadTypeLi VariantCopy SafeArrayRedim SafeArrayGetLBound VarBstrCmp SysStringByteLen SysFreeString SysAllocStringByteLen SafeArrayDestroy SysAllocString SafeArrayGetVartype VariantClear VariantCopyInd SysAllocStringLen SafeArrayCreate VariantInit LoadRegTypeLi

winspool.drv

DocumentEvent GetFormA SetDefaultPrinterW ResetPrinterA DeletePortW AddPrinterDriverExW GetPrinterDriverDirectoryA SetPrinterA DeletePrinterDriverExA ConvertUnicodeDevModeToAnsiDevmode AddPrinterW GetPrinterDataExW EnumFormsA AddPortA GetJobA SpoolerPrinterEvent StartDocPrinterA GetPrinterDataA DeletePrinterKeyW DeletePrinterDriverExW DeviceMode

mciseq

DriverProc

Name

.IbcElXf

Size

2KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_MEM_READ

Name

.rggfMqQ

Size

1KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_MEM_READ

Name

.RXnGQm

Size

2KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_MEM_READ

Name

.zfHhiu

Size

2KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_MEM_READ

Name

.text

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.IWuLK

Size

512B

Virtual Size

471B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.XIPdBUZ

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pCfplj

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

9KB

Virtual Size

265KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.YHERtr

Size

512B

Virtual Size

399B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

208KB

Virtual Size

207KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.TgbqLOT

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.beAypYZ

Size

512B

Virtual Size

185B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.VdrBmm

Size

1024B

Virtual Size

916B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_HEUR.Trojan.Win32.Generic.49d3562793fa6f740d33f4956d017ba7

userenv

advapi32

kernel32

ole32

user32

oleaut32

winspool.drv

mciseq

generic