jaffacakes118_HEUR[.]Trojan[.]Win32[.]Generic[.]3c7e71e56edc7b143d6789d3d61db671

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.3c7e71e56edc7b143d6789d3d61db671
Size 25KB
Sample261014-cdtt7sty8r
SHA256 3098b518e80520ecd9dd0b9a6cb5af6be90722989f57cb44d21b3460c26b3baf
MD5 3c7e71e56edc7b143d6789d3d61db671
SHA1 866f1397372444e9610d6bcd364d4bd05249f23a
SHA512 4b29257626f88d6fac109f5772442d7e30e7ca81747ba1e4dafd69c0f87ce16a8a6912bd3d36f48546342ae86cfec37ad99c1a976f6ccb1e5d95e52519958b0b
SSDEEP 384:aYdiYgNaORFB2nkNXaU25aJzT77bUHcV+Z2Y6awzgaRWBRdILT35:7dfORp9aU2gVT7cHcsZ56hzvRWBMLT35
TLSH
T1EDC23A13B30B45A2E2C6153071812FBA9FFC24711F0A5666DFA2978B5CB46C7EE72247
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_HEUR.Trojan.Win32.Generic.3c7e71e56edc7b143d6789d3d61db671

File Explorer

jaffacakes118_HEUR.Trojan.Win32.Generic.3c7e71e56edc7b143d6789d3d61db671

.dll 25KB

jaffacakes118_HEUR.Trojan.Win32.Generic.3c7e71e56edc7b143d6789d3d61db671

IMPHASH 02cd2de1105ea5239231427f753a9aa5
SHA256 3098b518e80520ecd9dd0b9a6cb5af6be90722989f57cb44d21b3460c26b3baf
MD5 3c7e71e56edc7b143d6789d3d61db671
SHA1 866f1397372444e9610d6bcd364d4bd05249f23a
SHA512 4b29257626f88d6fac109f5772442d7e30e7ca81747ba1e4dafd69c0f87ce16a8a6912bd3d36f48546342ae86cfec37ad99c1a976f6ccb1e5d95e52519958b0b
SSDEEP 384:aYdiYgNaORFB2nkNXaU25aJzT77bUHcV+Z2Y6awzgaRWBRdILT35:7dfORp9aU2gVT7cHcsZ56hzvRWBMLT35
TLSH
T1EDC23A13B30B45A2E2C6153071812FBA9FFC24711F0A5666DFA2978B5CB46C7EE72247
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

19208

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

Sleep CreateThread WaitForSingleObject ReadFile SetFilePointer GetLastError CreateEventA GetModuleFileNameA GetTempPathA GetWindowsDirectoryA GetSystemDirectoryA SetFileAttributesA DeleteFileA CreateFileA CloseHandle LoadLibraryA GetProcAddress GlobalAlloc VirtualProtect GetCommandLineA ExitProcess IsBadReadPtr GetCurrentDirectoryA GetPrivateProfileStringA

user32

GetParent GetWindowThreadProcessId EnumWindows wsprintfA GetWindowTextA

msvcp60

??0_Lockit@std@@QAE@XZ ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB ?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ??0Init@ios_base@std@@QAE@XZ ??1Init@ios_base@std@@QAE@XZ ??0_Winit@std@@QAE@XZ ??1_Winit@std@@QAE@XZ ??1_Lockit@std@@QAE@XZ

ws2_32

inet_ntoa send recv socket inet_addr htons connect closesocket gethostbyname WSACleanup WSAStartup

wininet

InternetOpenUrlA InternetCloseHandle InternetReadFile InternetOpenA

msvcrt

_access strrchr strchr strncpy strstr __dllonexit _onexit _initterm _adjust_fdiv _getpid _stricmp _strlwr _strrev free malloc ??2@YAPAXI@Z memcpy __CxxFrameHandler strcmp atoi sprintf memset strlen strcat strcpy

netapi32

Netbios