jaffacakes118_HEUR[.]Trojan[.]Win32[.]Generic[.]3eb3d321ae083583a798dc398dca10ff

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.3eb3d321ae083583a798dc398dca10ff
Size 111KB
Sample261014-clrptaev2x
SHA256 c85e2f71b57d9770fdb0c35226eda672fae04d686ef4275896b0d6117e249eed
MD5 3eb3d321ae083583a798dc398dca10ff
SHA1 288c45375f691e95897f968e99c0248b9a2acad9
SHA512 ae39992c0b50b9ca1e8a6fd7f6ac3645057695757929174b87671021876f58db253a9c2dcb56b78ece9a3ee7ffb5a0d3588afa99fdb4ef00a6b42d19ad1904e3
SSDEEP 3072:h51cgW2Otk+3cDl0o1bZwYkBfhq3vaofsAR6fdwt8jdWMunmAqet/Bu:urk+Mx9e3f
TLSH
T135B307117BFA4266F5F3ABB07DF94233593ABDA0AD34C6AD1391160E1D34A21C964B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_HEUR.Trojan.Win32.Generic.3eb3d321ae083583a798dc398dca10ff

File Explorer

jaffacakes118_HEUR.Trojan.Win32.Generic.3eb3d321ae083583a798dc398dca10ff

.dll 111KB

jaffacakes118_HEUR.Trojan.Win32.Generic.3eb3d321ae083583a798dc398dca10ff

IMPHASH 82f3f55bb5115d686508ba81f29860ff
SHA256 c85e2f71b57d9770fdb0c35226eda672fae04d686ef4275896b0d6117e249eed
MD5 3eb3d321ae083583a798dc398dca10ff
SHA1 288c45375f691e95897f968e99c0248b9a2acad9
SHA512 ae39992c0b50b9ca1e8a6fd7f6ac3645057695757929174b87671021876f58db253a9c2dcb56b78ece9a3ee7ffb5a0d3588afa99fdb4ef00a6b42d19ad1904e3
SSDEEP 3072:h51cgW2Otk+3cDl0o1bZwYkBfhq3vaofsAR6fdwt8jdWMunmAqet/Bu:urk+Mx9e3f
TLSH
T135B307117BFA4266F5F3ABB07DF94233593ABDA0AD34C6AD1391160E1D34A21C964B33
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

28797

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

UnhandledExceptionFilter SetUnhandledExceptionFilter GetModuleFileNameW lstrcmpiW InitializeCriticalSection GetCurrentProcess CloseHandle TerminateProcess lstrlenW VirtualUnlock WaitForSingleObject CreateWaitableTimerA InitializeCriticalSectionAndSpinCount Sleep GetCurrentDirectoryW GetFullPathNameA SetCurrentDirectoryW GetFullPathNameW CreateFileA CreateFileW UnmapViewOfFile lstrlenA lstrcpynW LocalAlloc GetLastError SetLastError VirtualProtect DeleteCriticalSection LocalFree LeaveCriticalSection WideCharToMultiByte EnterCriticalSection GetComputerNameW GetTickCount GetCommandLineA InterlockedDecrement

user32

SetRect CloseDesktop CloseWindowStation SetProcessWindowStation SetThreadDesktop CharNextW

advapi32

LsaQueryInformationPolicy SetSecurityDescriptorOwner RegDeleteKeyW RegEnumKeyExW RegDeleteValueW RegOpenKeyExW RegCreateKeyExW RegCloseKey LsaNtStatusToWinError LsaFreeMemory SystemFunction008 SystemFunction006 LsaClose LsaOpenPolicy SetSecurityDescriptorDacl SetServiceStatus SetSecurityDescriptorGroup

gdi32

CreateRectRgn CombineRgn DeleteObject

ole32

CoTaskMemFree CoUninitialize CoInitializeSecurity StringFromCLSID CoCreateInstance CoTaskMemAlloc

msvcrt

__CxxFrameHandler _except_handler3 strncpy wcslen wcscpy free rand _wcsicmp malloc _adjust_fdiv _initterm

msvcp60

?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z ?_Freeze@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ??Ostd@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z ??Mstd@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z ??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z ??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z ??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z