jaffacakes118_HEUR[.]Trojan[.]Win32[.]Generic[.]41dbe6351116d1660da41b6b65056d3a

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.41dbe6351116d1660da41b6b65056d3a
Size 176KB
Sample261014-ctn9naxtcx
SHA256 4d25296ccd2018f47c3afa40f7d609fec24bb5d7e49ecd942584ba685e1cbc22
MD5 41dbe6351116d1660da41b6b65056d3a
SHA1 fa8690ca54eff1eafa9b807e537c24e978cef359
SHA512 318d07b1c5d94d2d9d015b25b6722144c6f7d215ae665ad8aa5a73100f753dc0fdfa6083714b5a0d880eb6b93abe34f011be7e24daf237b71d157fbf4c366fc6
SSDEEP 1536:cN4GCi2C93ZRAQe8C73JgcsRMIQdRqGYteo8+ud1g7hmM+MjwfYvtb7Pq4qie+PI:GPnpC9gHteo8ZgVaY11qie+Pfm2Kx
TLSH
T19104F194558DE63DC44F6CF0F3F1A6A095144A7C46DF0F66BE4B8BA2B03826222BDD47
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_HEUR.Trojan.Win32.Generic.41dbe6351116d1660da41b6b65056d3a

File Explorer

jaffacakes118_HEUR.Trojan.Win32.Generic.41dbe6351116d1660da41b6b65056d3a

.exe 176KB

jaffacakes118_HEUR.Trojan.Win32.Generic.41dbe6351116d1660da41b6b65056d3a

IMPHASH 183adc57ba90c8e0cf8767c1bfa3ffc3
SHA256 4d25296ccd2018f47c3afa40f7d609fec24bb5d7e49ecd942584ba685e1cbc22
MD5 41dbe6351116d1660da41b6b65056d3a
SHA1 fa8690ca54eff1eafa9b807e537c24e978cef359
SHA512 318d07b1c5d94d2d9d015b25b6722144c6f7d215ae665ad8aa5a73100f753dc0fdfa6083714b5a0d880eb6b93abe34f011be7e24daf237b71d157fbf4c366fc6
SSDEEP 1536:cN4GCi2C93ZRAQe8C73JgcsRMIQdRqGYteo8+ud1g7hmM+MjwfYvtb7Pq4qie+PI:GPnpC9gHteo8ZgVaY11qie+Pfm2Kx
TLSH
T19104F194558DE63DC44F6CF0F3F1A6A095144A7C46DF0F66BE4B8BA2B03826222BDD47
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

20508

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CloseHandle DuplicateHandle GetCurrentProcess OpenProcess WriteFile CreateFileA SetFileTime GetFileAttributesExA LoadLibraryA WideCharToMultiByte FreeLibrary TerminateProcess WaitForSingleObject CreateProcessA GetVersionExA GetStartupInfoA GetModuleHandleA GetProcAddress GetLastError WinExec GetSystemDirectoryA Sleep GetModuleFileNameA

user32

GetMessageA DefWindowProcA PostQuitMessage TranslateMessage RegisterWindowMessageA GetClassNameA PostMessageA EnumChildWindows GetWindowThreadProcessId EnumWindows RegisterClassExA ShowWindow GetDesktopWindow DispatchMessageA SendMessageTimeoutA CreateWindowExA

advapi32

OpenServiceA RegQueryValueExA RegOpenKeyExA CloseServiceHandle OpenSCManagerA ConvertSidToStringSidA LookupAccountNameA GetUserNameA CreateServiceA DeleteService StartServiceA RegCloseKey

shell32

SHGetSpecialFolderPathA

ole32

CoInitialize CoUninitialize

oleaut32

SysFreeString VariantClear

msvcrt

__CxxFrameHandler _strlwr _controlfp _except_handler3 __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _acmdln exit _XcptFilter _exit time srand ??2@YAPAXI@Z ??3@YAXPAX@Z _stricmp sprintf rand _access fclose fflush fwrite fopen wcslen atoi strchr strstr

shlwapi

SHSetValueA SHGetValueA

dbghelp

ImageNtHeader

Name

.text

Size

20KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

120KB

Virtual Size

117KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

odata

Size

4KB

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

ndata

Size

4KB

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

mdata

Size

4KB

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

edata

Size

4KB

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

cdata

Size

4KB

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

idata

Size

4KB

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_HEUR.Trojan.Win32.Generic.41dbe6351116d1660da41b6b65056d3a

kernel32

user32

advapi32

shell32

ole32

oleaut32

msvcrt

shlwapi

dbghelp

generic