jaffacakes118_HEUR[.]Trojan[.]Win32[.]Generic[.]3f7fe9710734e10aecadd36bd593803b

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.3f7fe9710734e10aecadd36bd593803b
Size 892KB
Sample261014-cpj45seb49
SHA256 15e5b37d58705676e26d08563e0b8d9baa0185fc9647d6542a82d45f45feca53
MD5 3f7fe9710734e10aecadd36bd593803b
SHA1 5480908cb0605be2d724a4573174db9ba772b6da
SHA512 acd564f63177681201c417c1cc21b54483e5e9a91cf1f3c22669b14a22db6738d5b1e0abbece74ffea7c4336c123d1ba303311451a6f59dceee1c1db14c3ccf2
SSDEEP 12288:mLE1Z9Az+bvSLW3Hm9eBYpQ6BzGc+DLXNqbTMonZ7mIKp:mLE1Z9ASbvKlFRGcqLXNGT5Bl
TLSH
T182154930670DC53AC7EE06794C3AC71F287DB6894B3824D3B2E46B9EAD744D12A3615B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_HEUR.Trojan.Win32.Generic.3f7fe9710734e10aecadd36bd593803b

File Explorer

jaffacakes118_HEUR.Trojan.Win32.Generic.3f7fe9710734e10aecadd36bd593803b

.dll 892KB

jaffacakes118_HEUR.Trojan.Win32.Generic.3f7fe9710734e10aecadd36bd593803b

IMPHASH ae2cc56a55439b09e11ebec458ec4db6
SHA256 15e5b37d58705676e26d08563e0b8d9baa0185fc9647d6542a82d45f45feca53
MD5 3f7fe9710734e10aecadd36bd593803b
SHA1 5480908cb0605be2d724a4573174db9ba772b6da
SHA512 acd564f63177681201c417c1cc21b54483e5e9a91cf1f3c22669b14a22db6738d5b1e0abbece74ffea7c4336c123d1ba303311451a6f59dceee1c1db14c3ccf2
SSDEEP 12288:mLE1Z9Az+bvSLW3Hm9eBYpQ6BzGc+DLXNqbTMonZ7mIKp:mLE1Z9ASbvKlFRGcqLXNGT5Bl
TLSH
T182154930670DC53AC7EE06794C3AC71F287DB6894B3824D3B2E46B9EAD744D12A3615B
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7383

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

rpcrt4

NdrClientCall2 RpcBindingFree RpcStringBindingComposeA RpcStringFreeA RpcBindingFromStringBindingA

kernel32

HeapDestroy GetSystemDirectoryW FileTimeToSystemTime GetCurrentProcess GetLocalTime GetTimeZoneInformation GetComputerNameA GetACP LocalFree OpenProcess GetVersionExA GetVolumeInformationA TerminateProcess GetCurrentThread CreateMutexA ReleaseMutex FlushFileBuffers CreateRemoteThread WriteProcessMemory VirtualAllocEx OpenSemaphoreA GetDriveTypeA ExpandEnvironmentStringsA OpenMutexA RemoveDirectoryA CreateDirectoryA GetWindowsDirectoryA GetProcessHeap GetFullPathNameA GetComputerNameW GetShortPathNameA GetNumberFormatA GetLocaleInfoA HeapCreate GetStartupInfoA GetFileType SetHandleCount GetStringTypeW GetStringTypeA HeapSize HeapReAlloc VirtualAlloc VirtualFree LCMapStringW LCMapStringA ExitProcess GetStdHandle IsValidCodePage GetOEMCP GetCPInfo TlsFree TlsSetValue TlsAlloc TlsGetValue GetCommandLineA IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetDateFormatA GetTimeFormatA RaiseException FileTimeToLocalFileTime CreateThread ExitThread RtlUnwind GetSystemTimeAsFileTime HeapFree HeapAlloc OpenFileMappingA lstrlenA WideCharToMultiByte InterlockedDecrement DeviceIoControl DisableThreadLibraryCalls GetCurrentProcessId SetLastError ResetEvent SetThreadPriority TerminateThread GetConsoleMode GetFileTime SetFileTime OutputDebugStringA CreateFileMappingA MapViewOfFile UnmapViewOfFile SetEndOfFile GetFileSize GetCurrentDirectoryA SetCurrentDirectoryA FindFirstFileA GetFileAttributesA SetFileAttributesA FindNextFileA FindClose InitializeCriticalSection CreateEventA ResumeThread SetEvent InterlockedIncrement GetCurrentThreadId SetStdHandle WriteConsoleA GetConsoleOutputCP EnterCriticalSection LeaveCriticalSection WaitForSingleObject DeleteCriticalSection GetDiskFreeSpaceA FreeLibrary LoadLibraryA GetProcAddress GetLastError FormatMessageA DeleteFileA MoveFileA GetVersion GetSystemDirectoryA GetTickCount MultiByteToWideChar WriteFile Sleep ReadFile SetFilePointer CloseHandle VirtualProtect GetModuleHandleA GetModuleFileNameA CreateFileA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetConsoleCP WriteConsoleW CompareStringA CompareStringW SetEnvironmentVariableA

user32

UnregisterHotKey RegisterHotKey LoadIconA LoadCursorA ToAsciiEx GetKeyboardLayout AppendMenuA TrackPopupMenu DestroyMenu LoadImageA SetTimer CallNextHookEx GetKeyNameTextA GetKeyState GetAsyncKeyState GetKeyboardLayoutNameA EnumDisplaySettingsA FindWindowA GetWindowThreadProcessId OpenDesktopA OpenInputDesktop GetProcessWindowStation GetThreadDesktop PostQuitMessage UnhookWindowsHookEx SetWindowsHookExA GetSystemMetrics EnumWindows OpenWindowStationA GetUserObjectInformationA SetThreadDesktop SetProcessWindowStation CloseDesktop CloseWindowStation ExitWindowsEx MessageBoxA LoadStringA SendMessageA DialogBoxParamA SetWindowTextA SetDlgItemTextA SetPropA SetForegroundWindow EndDialog PostThreadMessageA GetClassNameA GetWindowRect GetDC ReleaseDC GetMessageA TranslateMessage DispatchMessageA KillTimer DestroyWindow UnregisterClassA RegisterClassA CreateWindowExA GetWindowLongA DefWindowProcA IsWindow SetWindowLongA GetCursorPos PostMessageA wsprintfA wsprintfW GetForegroundWindow MapVirtualKeyExA MapVirtualKeyA CreatePopupMenu

gdi32

GetDeviceCaps DeleteObject DeleteDC CreateDIBSection CreateCompatibleDC GdiFlush BitBlt SelectObject CreateCompatibleBitmap CreateDCA GetStockObject

advapi32

RegQueryValueExA InitiateSystemShutdownA OpenSCManagerA OpenServiceA CloseServiceHandle DeleteService LogonUserA RegEnumValueA RegEnumKeyExA RegDeleteKeyA RegDeleteValueA RegSetKeySecurity RegOpenKeyExA RegGetKeySecurity RevertToSelf GetSidLengthRequired LookupAccountSidA ImpersonateLoggedOnUser DuplicateToken GetTokenInformation GetSecurityInfo SetEntriesInAclA SetSecurityInfo OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges InitializeSecurityDescriptor SetSecurityDescriptorDacl GetUserNameA RegSetValueExA RegCloseKey RegCreateKeyExA

shell32

SHGetMalloc SHGetSpecialFolderLocation SHGetPathFromIDListA ShellExecuteA Shell_NotifyIconA SHLoadInProc

ole32

StringFromCLSID CoCreateInstance CoInitialize CoUninitialize CoTaskMemFree

oleaut32

VARIANT_UserSize SafeArrayLock SafeArrayCreate VariantInit VariantClear SysAllocStringLen SysAllocString SysStringLen SysFreeString SafeArrayUnlock VARIANT_UserMarshal VARIANT_UserUnmarshal VARIANT_UserFree

Name

.text

Size

548KB

Virtual Size

547KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

248KB

Virtual Size

246KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

40KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.shared

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

8KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

40KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_HEUR.Trojan.Win32.Generic.3f7fe9710734e10aecadd36bd593803b

version

rpcrt4

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

generic