jaffacakes118_HEUR[.]Trojan[.]Win32[.]Generic[.]3ba3846901198fa77911187e0e97bc0e

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.3ba3846901198fa77911187e0e97bc0e
Size 52KB
Sample261014-cavbkaet2w
SHA256 4c873ace78267490bd94db15ba380aa7c6b45ea912f3691da443552ace58562f
MD5 3ba3846901198fa77911187e0e97bc0e
SHA1 3a41f78207b52b7fa96f690d8ed6def5e4d59474
SHA512 e79e38ad8a799e200350832b4d04789599e46ceafbd1e629a991fb8546152d916bea9baeda07d4f725d2a19e344556d41e1fdf5f1dfaae68aa29c683642e0bd7
SSDEEP 1536:zN8BFrfu6lIPTzDmsIO1QniRaZZIfdoXgUqMNQ:ZUFVw0diRaQd3M
TLSH
T167335B1B7692C372C3E21734F1196B213FBDA5362C492495C753D9D23BF0296EEB920A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_HEUR.Trojan.Win32.Generic.3ba3846901198fa77911187e0e97bc0e

File Explorer

jaffacakes118_HEUR.Trojan.Win32.Generic.3ba3846901198fa77911187e0e97bc0e

.dll 52KB

jaffacakes118_HEUR.Trojan.Win32.Generic.3ba3846901198fa77911187e0e97bc0e

IMPHASH 4a925160ffa9fa221d13d425138128d0
SHA256 4c873ace78267490bd94db15ba380aa7c6b45ea912f3691da443552ace58562f
MD5 3ba3846901198fa77911187e0e97bc0e
SHA1 3a41f78207b52b7fa96f690d8ed6def5e4d59474
SHA512 e79e38ad8a799e200350832b4d04789599e46ceafbd1e629a991fb8546152d916bea9baeda07d4f725d2a19e344556d41e1fdf5f1dfaae68aa29c683642e0bd7
SSDEEP 1536:zN8BFrfu6lIPTzDmsIO1QniRaZZIfdoXgUqMNQ:ZUFVw0diRaQd3M
TLSH
T167335B1B7692C372C3E21734F1196B213FBDA5362C492495C753D9D23BF0296EEB920A
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

32875

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

WaitForSingleObject CreateProcessA GetSystemDirectoryA Sleep RemoveDirectoryA MoveFileA SetFileAttributesA ExitProcess FindNextFileA GetPrivateProfileStringA FindFirstFileA Process32Next Process32First CloseHandle EnterCriticalSection DisableThreadLibraryCalls InitializeCriticalSection DeleteCriticalSection InterlockedIncrement InterlockedDecrement HeapDestroy GetShortPathNameA GetModuleHandleA WritePrivateProfileStringA CreateDirectoryA GetCommandLineW GetExitCodeProcess GetCurrentProcessId LocalFree DeleteFileA CreateThread GetModuleFileNameA lstrlenW WideCharToMultiByte lstrlenA MultiByteToWideChar LoadLibraryA FreeLibrary GetProcAddress LeaveCriticalSection

advapi32

GetNamedSecurityInfoA RegSetValueExA BuildExplicitAccessWithNameA SetEntriesInAclA SetNamedSecurityInfoA RegEnumKeyExA RegDeleteKeyA RegCloseKey RegOpenKeyExA RegQueryInfoKeyA RegQueryValueExA RegCreateKeyExA

shell32

SHGetSpecialFolderPathA CommandLineToArgvW

ole32

CoMarshalInterThreadInterfaceInStream CoGetInterfaceAndReleaseStream CoInitialize CoUninitialize CoCreateInstance

oleaut32

SysStringLen LoadRegTypeLi VariantClear SysAllocString SysFreeString

msvcrt

strrchr _strlwr _stricmp _adjust_fdiv malloc _initterm free strcmp _purecall memcpy _wcslwr wcsstr atoi strncmp strchr strncpy ??3@YAXPAX@Z memcmp fclose fread memset ??2@YAPAXI@Z ftell fseek fopen strcat _strupr sprintf strlen strcpy _access strstr

shlwapi

SHSetValueA SHDeleteKeyA SHDeleteValueA