jaffacakes118_HEUR[.]Trojan[.]Win32[.]Generic[.]42e3ee697c444602e944c8d1b83b4505

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.42e3ee697c444602e944c8d1b83b4505
Size 180KB
Sample261014-cv1dbaxtes
SHA256 ba644ab2fab81a7625b39be611dfa27d97bf6ee28db5f708a7d3836c548299ab
MD5 42e3ee697c444602e944c8d1b83b4505
SHA1 f56d544d343170472d25132aef693123b6edc1b4
SHA512 ce5df9360264852d45204c126eaa7f4ccf581ce6e49ac49dd1213c69a61ad63e324f1aa5416c9b310d193d43b80d4de30e3d6ce3168cb11ed576e44c99bd23f6
SSDEEP 3072:Cf8Gn4WhAJnGR/09uCloMDOfygDB+Kp7A0UBoFKE/K7:w5nN+dGp0ydxuMKE/K7
TLSH
T18B045803DBC0A0B3F4A8ACF0D8A73AA7086D2DD405FDDD0579658DB51222E9512B7A7F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_HEUR.Trojan.Win32.Generic.42e3ee697c444602e944c8d1b83b4505

File Explorer

jaffacakes118_HEUR.Trojan.Win32.Generic.42e3ee697c444602e944c8d1b83b4505

.exe 180KB

jaffacakes118_HEUR.Trojan.Win32.Generic.42e3ee697c444602e944c8d1b83b4505

IMPHASH 9c2aa68e517667a9b22069a7ce686fa1
SHA256 ba644ab2fab81a7625b39be611dfa27d97bf6ee28db5f708a7d3836c548299ab
MD5 42e3ee697c444602e944c8d1b83b4505
SHA1 f56d544d343170472d25132aef693123b6edc1b4
SHA512 ce5df9360264852d45204c126eaa7f4ccf581ce6e49ac49dd1213c69a61ad63e324f1aa5416c9b310d193d43b80d4de30e3d6ce3168cb11ed576e44c99bd23f6
SSDEEP 3072:Cf8Gn4WhAJnGR/09uCloMDOfygDB+Kp7A0UBoFKE/K7:w5nN+dGp0ydxuMKE/K7
TLSH
T18B045803DBC0A0B3F4A8ACF0D8A73AA7086D2DD405FDDD0579658DB51222E9512B7A7F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

20668

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

WaitForSingleObject CreateProcessA GetVersionExA CreateFileA TerminateProcess DuplicateHandle GetCurrentProcess OpenProcess WriteFile WinExec GetModuleFileNameA GetStartupInfoA GetModuleHandleA LoadLibraryA GetProcAddress CloseHandle Sleep FreeLibrary WideCharToMultiByte GetLastError GetSystemDirectoryA GetFileAttributesExA SetFileTime

user32

RegisterWindowMessageA GetClassNameA PostMessageA SendMessageTimeoutA GetWindowThreadProcessId EnumWindows DefWindowProcA PostQuitMessage RegisterClassExA DispatchMessageA GetDesktopWindow TranslateMessage CreateWindowExA ShowWindow EnumChildWindows GetMessageA

advapi32

RegQueryValueExA OpenSCManagerA CreateServiceA DeleteService OpenServiceA ConvertSidToStringSidA LookupAccountNameA GetUserNameA StartServiceA RegCloseKey RegOpenKeyExA CloseServiceHandle

shell32

SHGetSpecialFolderPathA

ole32

CoInitialize CoUninitialize

oleaut32

SysFreeString VariantClear

msvcrt

fopen _strlwr _controlfp _except_handler3 __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _acmdln exit _XcptFilter _exit ??2@YAPAXI@Z ??3@YAXPAX@Z time srand _stricmp rand wcslen atoi strchr strstr __CxxFrameHandler sprintf _access fclose fflush fwrite

shlwapi

SHSetValueA SHGetValueA

dbghelp

ImageNtHeader

Name

.text

Size

20KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

120KB

Virtual Size

117KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

qdata

Size

4KB

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

odata

Size

4KB

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

ndata

Size

4KB

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

mdata

Size

4KB

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

edata

Size

4KB

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

cdata

Size

4KB

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

idata

Size

4KB

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_HEUR.Trojan.Win32.Generic.42e3ee697c444602e944c8d1b83b4505

kernel32

user32

advapi32

shell32

ole32

oleaut32

msvcrt

shlwapi

dbghelp

generic