jaffacakes118_HEUR[.]Trojan[.]Win32[.]Generic[.]4b15864e4b49b06bde5ac75f88a115a3

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.4b15864e4b49b06bde5ac75f88a115a3
Size 43KB
Sample261014-c871baxway
SHA256 bbe3ea82b262aeaee2794ccd61c30422f23d887c36f084cf6ba1adcaafa18fd1
MD5 4b15864e4b49b06bde5ac75f88a115a3
SHA1 26b6c3f0d7b541dae32c84bf5f27e3b5783b2ee7
SHA512 c5025a087398a55c4493b5cc9612e16c8cf162dfe737b4f1a5ff1881e7990c97b5977fdbd515d0d38f3f840f14a6f49b68e3a3d1bf6869735673fc7ea057ef28
SSDEEP 384:jYegYTmY3OLlDhVutD+tLexkF90OyECExuTiGjhR5q95F:jYegYTsllVu9+NeWFymCExGly95
TLSH
T11E131A073F2548B2C299413C606EAB355BFDAC3899E47467DFD3219ECCB809BE635206
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_HEUR.Trojan.Win32.Generic.4b15864e4b49b06bde5ac75f88a115a3

File Explorer

jaffacakes118_HEUR.Trojan.Win32.Generic.4b15864e4b49b06bde5ac75f88a115a3

.dll 43KB

jaffacakes118_HEUR.Trojan.Win32.Generic.4b15864e4b49b06bde5ac75f88a115a3

IMPHASH c425b8a8134e5afb1685c172b751cfc8
SHA256 bbe3ea82b262aeaee2794ccd61c30422f23d887c36f084cf6ba1adcaafa18fd1
MD5 4b15864e4b49b06bde5ac75f88a115a3
SHA1 26b6c3f0d7b541dae32c84bf5f27e3b5783b2ee7
SHA512 c5025a087398a55c4493b5cc9612e16c8cf162dfe737b4f1a5ff1881e7990c97b5977fdbd515d0d38f3f840f14a6f49b68e3a3d1bf6869735673fc7ea057ef28
SSDEEP 384:jYegYTmY3OLlDhVutD+tLexkF90OyECExuTiGjhR5q95F:jYegYTsllVu9+NeWFymCExGly95
TLSH
T11E131A073F2548B2C299413C606EAB355BFDAC3899E47467DFD3219ECCB809BE635206
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5358

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

VirtualFreeEx VirtualAllocEx FindClose FindNextFileA lstrcmpiA lstrcatA GetCurrentProcess Module32First VirtualProtectEx CreateProcessA GetModuleHandleA ResumeThread ReleaseMutex CreateMutexA GetModuleFileNameA CopyFileA TerminateProcess VirtualProtect VirtualFree VirtualAlloc InitializeCriticalSection GetTempPathA CreateFileA ReadFile GetLastError CloseHandle GetCurrentProcessId DisableThreadLibraryCalls WaitForSingleObject Sleep LoadLibraryA GetProcAddress WinExec lstrcpyA lstrlenA GetTickCount EnterCriticalSection LeaveCriticalSection DeleteCriticalSection

user32

wsprintfA SetThreadDesktop OpenWindowStationA GetClientRect GetClassNameA GetWindowTextA GetForegroundWindow OpenDesktopA

advapi32

SetSecurityDescriptorDacl OpenProcessToken LookupPrivilegeValueA

msvcp60

?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z ?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z ?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB

ws2_32

getpeername WSAStartup closesocket send recv select connect ioctlsocket htons socket gethostbyname

msvcrt

_beginthreadex strncpy sprintf strlen strcat free malloc strstr strncmp atoi strncat _purecall _splitpath wcscmp strchr memset memcpy __CxxFrameHandler ??2@YAPAXI@Z strcpy sscanf

shlwapi

StrStrIA