jaffacakes118_HEUR[.]Trojan[.]Win32[.]Generic[.]3d49b4a8d830e7de53134112481a165a

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.3d49b4a8d830e7de53134112481a165a
Size 260KB
Sample261014-cfpchaez4j
SHA256 997a7b8956036f53af45b6ded62e704a197a7321f708acf9e467ce908c493c57
MD5 3d49b4a8d830e7de53134112481a165a
SHA1 9a20a84c88193a24fe225d4b7c23ce46d05c306b
SHA512 a8f104fd409c2e45f96585ceed67349e4a87e431260b018d318703139f978056eb744111f561083f7b326e29f1227a2e8029a80a2f45b277a1ca593fe83e8ac0
SSDEEP 6144:vAPTOCuq51JsmiQFF0kJNOlsh2IiobuUnGsf8AD:voB7BsHQz8JmG0D
TLSH
T1C14412E5A5722EA7C42149B914ABE530317D4E563B92423FAFC0ACAF3CB35D1ADE1530
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_HEUR.Trojan.Win32.Generic.3d49b4a8d830e7de53134112481a165a

File Explorer

jaffacakes118_HEUR.Trojan.Win32.Generic.3d49b4a8d830e7de53134112481a165a

.exe 260KB

jaffacakes118_HEUR.Trojan.Win32.Generic.3d49b4a8d830e7de53134112481a165a

IMPHASH f982bf68faea31fb085b9351d99b9619
SHA256 997a7b8956036f53af45b6ded62e704a197a7321f708acf9e467ce908c493c57
MD5 3d49b4a8d830e7de53134112481a165a
SHA1 9a20a84c88193a24fe225d4b7c23ce46d05c306b
SHA512 a8f104fd409c2e45f96585ceed67349e4a87e431260b018d318703139f978056eb744111f561083f7b326e29f1227a2e8029a80a2f45b277a1ca593fe83e8ac0
SSDEEP 6144:vAPTOCuq51JsmiQFF0kJNOlsh2IiobuUnGsf8AD:voB7BsHQz8JmG0D
TLSH
T1C14412E5A5722EA7C42149B914ABE530317D4E563B92423FAFC0ACAF3CB35D1ADE1530
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8728

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

mfc42u

ord823 ord825

msvcrt

free _beginthread

atl

ord21 ord18 ord22 ord15 ord16 ord44 ord43 ord32 ord58 ord23

kernel32

GetVersionExW SetEvent WaitForSingleObject IsBadReadPtr GetNumberFormatW GetLocaleInfoW GetCurrentProcess InitializeCriticalSection lstrlenW GetModuleFileNameW lstrcpyW GetShortPathNameW GetModuleHandleW lstrcmpiW GetWindowsDirectoryW GlobalAlloc GetModuleHandleA GetLastError LoadLibraryW LoadLibraryA ExpandEnvironmentStringsW lstrcmpW GetCurrentThread lstrcatW QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId SetUnhandledExceptionFilter MultiByteToWideChar lstrlenA LocalFree GetProcessHeap CreateEventW GetProcAddress

user32

SetWindowTextW SetFocus SendMessageW SetDlgItemTextW DialogBoxParamW SendDlgItemMessageW wsprintfW MessageBeep ShowWindow GetDlgItemInt EndDialog SetDlgItemInt LoadImageW SetCursor LoadCursorW ShowCursor IsWindow PeekMessageW SetWindowLongW PostMessageW EnableWindow GetDlgItemTextW LoadBitmapW IsDlgButtonChecked LoadIconW MessageBoxW WinHelpW GetSystemMetrics

advapi32

LookupPrivilegeValueW OpenThreadToken AdjustTokenPrivileges ImpersonateSelf RegOpenKeyW RegQueryValueExW GetUserNameW LookupAccountNameW RegEnumKeyExW RegSetValueExW RegOpenKeyExW GetTokenInformation RegDeleteKeyW RegCloseKey RegCreateKeyExW

oleaut32

SafeArrayGetLBound SafeArrayGetElement SysAllocStringByteLen VariantChangeType SafeArrayGetUBound SysStringByteLen VariantClear VariantInit SysStringLen SysAllocString SysFreeString

ole32

CoCreateInstance CoInitialize StringFromCLSID

gdi32

GetTextExtentPointW DeleteObject

shell32

ShellExecuteW

shlwapi

StrFormatByteSizeW

samlib

SamCloseHandle SamFreeMemory SamGetGroupsForUser SamSetMemberAttributesOfGroup SamiSetDSRMPasswordOWF SamCreateGroupInDomain SamGetAliasMembership SamEnumerateUsersInDomain SamGetDisplayEnumerationIndex

Name

.text

Size

14KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.Fq

Size

2KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.SBYeOU

Size

110KB

Virtual Size

192KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.MDnc

Size

2KB

Virtual Size

279KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.oFOQE

Size

3KB

Virtual Size

363KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.QHZGU

Size

3KB

Virtual Size

211KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

5KB

Virtual Size

268KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.kUM

Size

107KB

Virtual Size

189KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_HEUR.Trojan.Win32.Generic.3d49b4a8d830e7de53134112481a165a

mfc42u

msvcrt

atl

kernel32

user32

advapi32

oleaut32

ole32

gdi32

shell32

shlwapi

samlib

generic