jaffacakes118_HEUR[.]Trojan[.]Win32[.]Generic[.]3cf099f70e8aa32e3aa4926a319e559a

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.3cf099f70e8aa32e3aa4926a319e559a
Size 116KB
Sample261014-cet7csty9k
SHA256 9ffcada0e79ab61ee0c52d0da16c3e9b9f97fc5057efbc4a7be1d391be67e89f
MD5 3cf099f70e8aa32e3aa4926a319e559a
SHA1 3b3f1a8ee13de2cbacd16d2bf793cca97bb69310
SHA512 c1c1f33ea319c75c0f49c959c12334ba768b4f4b9f4d895a1d4935ce07f8dc8d68d5f2d9d8efaedb0890ef5cd83c3840a7966680444cbc4e9ead5f195a39d092
SSDEEP 1536:U395XZIcLULq26TtxohYBNxTxKaelcIJCcBIkLjV5By+ULvNsWbr0OP/rEtJWAEN:yHXZI76TvhxT4LtV33klsWBPQt4AEN
TLSH
T1CFC3F02AFB41EBCFF01942701D63AED6DBA8FE319E99170D7228370E1B773456242285
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_HEUR.Trojan.Win32.Generic.3cf099f70e8aa32e3aa4926a319e559a

File Explorer

jaffacakes118_HEUR.Trojan.Win32.Generic.3cf099f70e8aa32e3aa4926a319e559a

.dll 116KB

jaffacakes118_HEUR.Trojan.Win32.Generic.3cf099f70e8aa32e3aa4926a319e559a

IMPHASH 42afd655a352b35a2d23bab3ef1c60fe
SHA256 9ffcada0e79ab61ee0c52d0da16c3e9b9f97fc5057efbc4a7be1d391be67e89f
MD5 3cf099f70e8aa32e3aa4926a319e559a
SHA1 3b3f1a8ee13de2cbacd16d2bf793cca97bb69310
SHA512 c1c1f33ea319c75c0f49c959c12334ba768b4f4b9f4d895a1d4935ce07f8dc8d68d5f2d9d8efaedb0890ef5cd83c3840a7966680444cbc4e9ead5f195a39d092
SSDEEP 1536:U395XZIcLULq26TtxohYBNxTxKaelcIJCcBIkLjV5By+ULvNsWbr0OP/rEtJWAEN:yHXZI76TvhxT4LtV33klsWBPQt4AEN
TLSH
T1CFC3F02AFB41EBCFF01942701D63AED6DBA8FE319E99170D7228370E1B773456242285
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11384

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

atl

ord16 ord18 ord57 ord23 ord15 ord58 ord32 ord30 ord43 ord44 ord21

kernel32

VirtualAlloc VirtualFree HeapAlloc GetProcessHeap HeapFree GetSystemDirectoryW Sleep lstrcpynW GetVersionExW GetComputerNameExW GetCurrentProcess FlushInstructionCache LoadLibraryA CompareStringW InterlockedExchange GetComputerNameW LocalAlloc ExpandEnvironmentStringsA CreateActCtxW ReleaseActCtx ActivateActCtx DeactivateActCtx OutputDebugStringA GetModuleFileNameW LoadLibraryW GetVersion GetFileAttributesW GetProcAddress GetModuleHandleW GetModuleHandleA ExpandEnvironmentStringsW SetLastError GetLastError EnterCriticalSection LeaveCriticalSection InterlockedCompareExchange RtlUnwind QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter GetShortPathNameW InitializeCriticalSection DeleteCriticalSection InterlockedIncrement InterlockedDecrement DisableThreadLibraryCalls LocalFree lstrlenW

advapi32

RegOpenKeyExA RegQueryValueExA RegEnumValueW RegQueryInfoKeyW RegSetValueExW RegConnectRegistryW RegOpenKeyExW RegCreateKeyW RegOpenKeyW RegQueryValueExW RegCloseKey

shell32

SHBrowseForFolderW SHGetPathFromIDListW

ole32

StringFromGUID2 CoTaskMemAlloc CoInitializeEx CoCreateInstanceEx CoUninitialize CoCreateGuid CoSetProxyBlanket CoTaskMemFree

oleaut32

SysAllocStringByteLen SysAllocString LoadRegTypeLi SysStringLen SysFreeString SysStringByteLen

netapi32

NetUseAdd NetUseDel

ntdll

RtlQueryEnvironmentVariable_U RtlSetEnvironmentVariable RtlInitUnicodeString RtlExpandEnvironmentStrings_U RtlDestroyEnvironment RtlCreateEnvironment

Name

.text

Size

89KB

Virtual Size

160KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

192KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.edata

Size

512B

Virtual Size

165B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

216B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_HEUR.Trojan.Win32.Generic.3cf099f70e8aa32e3aa4926a319e559a

atl

kernel32

advapi32

shell32

ole32

oleaut32

netapi32

ntdll

generic