jaffacakes118_HEUR[.]Trojan[.]Win32[.]Generic[.]4abf69610db286038f802d11d23f2149

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.4abf69610db286038f802d11d23f2149
Size 260KB
Sample261014-c75tkavs9p
SHA256 4882de42faab5b5509653238d9bc0383a1cf4af3884d17e47d13bda074e75b99
MD5 4abf69610db286038f802d11d23f2149
SHA1 f256ebf53185593a43f3549a90babe6f02cc876f
SHA512 f4e3bd2b75ffc6b5e14075a952a472c8b89ce0b86c10adb9a1337d514fa50e8fa185547c833d539e52aa1e2e23fb4ebed62860b3035ac8730e25b29662d7a6e9
SSDEEP 6144:HAPTOCuq51JsmiQFF0kJNOlsh2IiobuUnGsf8AD:HoB7BsHQz8JmG0D
TLSH
T11D4412E5A5722EA7C42149B914ABE530317D4E563B92423FAFC0ACAF3CB35D1ADE1530
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_HEUR.Trojan.Win32.Generic.4abf69610db286038f802d11d23f2149

File Explorer

jaffacakes118_HEUR.Trojan.Win32.Generic.4abf69610db286038f802d11d23f2149

.exe 260KB

jaffacakes118_HEUR.Trojan.Win32.Generic.4abf69610db286038f802d11d23f2149

IMPHASH f982bf68faea31fb085b9351d99b9619
SHA256 4882de42faab5b5509653238d9bc0383a1cf4af3884d17e47d13bda074e75b99
MD5 4abf69610db286038f802d11d23f2149
SHA1 f256ebf53185593a43f3549a90babe6f02cc876f
SHA512 f4e3bd2b75ffc6b5e14075a952a472c8b89ce0b86c10adb9a1337d514fa50e8fa185547c833d539e52aa1e2e23fb4ebed62860b3035ac8730e25b29662d7a6e9
SSDEEP 6144:HAPTOCuq51JsmiQFF0kJNOlsh2IiobuUnGsf8AD:HoB7BsHQz8JmG0D
TLSH
T11D4412E5A5722EA7C42149B914ABE530317D4E563B92423FAFC0ACAF3CB35D1ADE1530
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8728

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

mfc42u

ord823 ord825

msvcrt

free _beginthread

atl

ord21 ord18 ord22 ord15 ord16 ord44 ord43 ord32 ord58 ord23

kernel32

GetVersionExW SetEvent WaitForSingleObject IsBadReadPtr GetNumberFormatW GetLocaleInfoW GetCurrentProcess InitializeCriticalSection lstrlenW GetModuleFileNameW lstrcpyW GetShortPathNameW GetModuleHandleW lstrcmpiW GetWindowsDirectoryW GlobalAlloc GetModuleHandleA GetLastError LoadLibraryW LoadLibraryA ExpandEnvironmentStringsW lstrcmpW GetCurrentThread lstrcatW QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId SetUnhandledExceptionFilter MultiByteToWideChar lstrlenA LocalFree GetProcessHeap CreateEventW GetProcAddress

user32

SetWindowTextW SetFocus SendMessageW SetDlgItemTextW DialogBoxParamW SendDlgItemMessageW wsprintfW MessageBeep ShowWindow GetDlgItemInt EndDialog SetDlgItemInt LoadImageW SetCursor LoadCursorW ShowCursor IsWindow PeekMessageW SetWindowLongW PostMessageW EnableWindow GetDlgItemTextW LoadBitmapW IsDlgButtonChecked LoadIconW MessageBoxW WinHelpW GetSystemMetrics

advapi32

LookupPrivilegeValueW OpenThreadToken AdjustTokenPrivileges ImpersonateSelf RegOpenKeyW RegQueryValueExW GetUserNameW LookupAccountNameW RegEnumKeyExW RegSetValueExW RegOpenKeyExW GetTokenInformation RegDeleteKeyW RegCloseKey RegCreateKeyExW

oleaut32

SafeArrayGetLBound SafeArrayGetElement SysAllocStringByteLen VariantChangeType SafeArrayGetUBound SysStringByteLen VariantClear VariantInit SysStringLen SysAllocString SysFreeString

ole32

CoCreateInstance CoInitialize StringFromCLSID

gdi32

GetTextExtentPointW DeleteObject

shell32

ShellExecuteW

shlwapi

StrFormatByteSizeW

samlib

SamCloseHandle SamFreeMemory SamGetGroupsForUser SamSetMemberAttributesOfGroup SamiSetDSRMPasswordOWF SamCreateGroupInDomain SamGetAliasMembership SamEnumerateUsersInDomain SamGetDisplayEnumerationIndex

Name

.text

Size

14KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.Fq

Size

2KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.SBYeOU

Size

110KB

Virtual Size

192KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.MDnc

Size

2KB

Virtual Size

279KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.oFOQE

Size

3KB

Virtual Size

363KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.QHZGU

Size

3KB

Virtual Size

211KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

5KB

Virtual Size

268KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.kUM

Size

107KB

Virtual Size

189KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_HEUR.Trojan.Win32.Generic.4abf69610db286038f802d11d23f2149

mfc42u

msvcrt

atl

kernel32

user32

advapi32

oleaut32

ole32

gdi32

shell32

shlwapi

samlib

generic