jaffacakes118_HEUR[.]Trojan[.]Win32[.]Generic[.]42beab0087a3df1675407f09d3d98168

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.42beab0087a3df1675407f09d3d98168
Size 2.0MB
Sample261014-cvbpysxtdv
SHA256 5b1f0abf680687021a7ff385a44dee5ffcaf06b52ecbb406c55567f2496a1b31
MD5 42beab0087a3df1675407f09d3d98168
SHA1 412ad11bc91574e7ce7104db333da9d6ee131467
SHA512 12c45328081b47a979927ae601c7234cd49c99a88acd73c94d959bf84530d1c26f2f35ae2e8b62939fee963d633e921852fbdc78832663d2c7b1685791ea6eee
SSDEEP 49152:gNYMxjc5fazxxeogqEggE9K7pUTWipdi0aedq7GjnQQQQ/PQ:iY+jIazxJgXx1Opdzh8anQQQQw
TLSH
T10AA52317F5E932F3D09D073C56DD9F1869A8AC6E3425823B7154F1FD28A7A020D853AE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_HEUR.Trojan.Win32.Generic.42beab0087a3df1675407f09d3d98168

File Explorer

jaffacakes118_HEUR.Trojan.Win32.Generic.42beab0087a3df1675407f09d3d98168

.exe 2.0MB

jaffacakes118_HEUR.Trojan.Win32.Generic.42beab0087a3df1675407f09d3d98168

IMPHASH 932fc7a56a3114ef207b8197affa389c
SHA256 5b1f0abf680687021a7ff385a44dee5ffcaf06b52ecbb406c55567f2496a1b31
MD5 42beab0087a3df1675407f09d3d98168
SHA1 412ad11bc91574e7ce7104db333da9d6ee131467
SHA512 12c45328081b47a979927ae601c7234cd49c99a88acd73c94d959bf84530d1c26f2f35ae2e8b62939fee963d633e921852fbdc78832663d2c7b1685791ea6eee
SSDEEP 49152:gNYMxjc5fazxxeogqEggE9K7pUTWipdi0aedq7GjnQQQQ/PQ:iY+jIazxJgXx1Opdzh8anQQQQw
TLSH
T10AA52317F5E932F3D09D073C56DD9F1869A8AC6E3425823B7154F1FD28A7A020D853AE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1118391

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

kernel32

DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection VirtualFree VirtualAlloc LocalFree LocalAlloc GetTickCount QueryPerformanceCounter GetVersion GetCurrentThreadId InterlockedDecrement InterlockedIncrement VirtualQuery WideCharToMultiByte SetCurrentDirectoryA MultiByteToWideChar lstrlenA lstrcpynA LoadLibraryExA GetThreadLocale GetStartupInfoA GetProcAddress GetModuleHandleA GetModuleFileNameA GetLocaleInfoA GetLastError GetCurrentDirectoryA GetCommandLineA FreeLibrary FindFirstFileA FindClose ExitProcess WriteFile UnhandledExceptionFilter SetFilePointer SetEndOfFile RtlUnwind ReadFile RaiseException GetStdHandle GetFileSize GetFileType CreateFileA CloseHandle TlsSetValue TlsGetValue LocalAlloc GetModuleHandleA lstrcpyA WriteProcessMemory WritePrivateProfileStringA WriteFile WaitForSingleObject VirtualQuery VirtualAllocEx VirtualAlloc TerminateProcess Sleep SizeofResource SetThreadLocale SetFilePointer SetEvent SetErrorMode SetEndOfFile SetCurrentDirectoryA ResumeThread ResetEvent ReadFile OpenProcess MulDiv LockResource LoadResource LoadLibraryA LeaveCriticalSection InitializeCriticalSection GlobalUnlock GlobalReAlloc GlobalHandle GlobalLock GlobalFree GlobalFindAtomA GlobalDeleteAtom GlobalAlloc GlobalAddAtomA GetVersionExA GetVersion GetTickCount GetThreadLocale GetTempPathA GetSystemInfo GetSystemDirectoryA GetStringTypeExA GetStdHandle GetProcAddress GetPrivateProfileStringA GetModuleHandleA GetModuleFileNameA GetLocaleInfoA GetLocalTime GetLastError GetFullPathNameA GetDiskFreeSpaceA GetDateFormatA GetCurrentThreadId GetCurrentProcessId GetCurrentProcess GetCPInfo GetACP FreeResource InterlockedExchange FreeLibrary FormatMessageA FindResourceA FindNextFileA FindFirstFileA FindClose FileTimeToLocalFileTime FileTimeToDosDateTime EnumCalendarInfoA EnterCriticalSection DeleteFileA DeleteCriticalSection CreateThread CreateRemoteThread CreateProcessA CreateMutexA CreateFileA CreateEventA CopyFileA CompareStringA CloseHandle Sleep LoadLibraryW FreeLibrary InitializeCriticalSection GetModuleFileNameW GetModuleHandleW TerminateProcess GetCurrentProcess DeleteCriticalSection CreateEventW CompareStringW SetLastError GetModuleHandleA VirtualProtect GetTickCount EnterCriticalSection LeaveCriticalSection VirtualFree VirtualAlloc WriteProcessMemory CreateToolhelp32Snapshot GetCurrentProcessId GetCurrentThreadId Thread32First OpenThread Thread32Next CloseHandle SuspendThread ResumeThread GetSystemInfo LoadResource MultiByteToWideChar WideCharToMultiByte FindResourceExW FindResourceExA GetThreadLocale GetUserDefaultLCID GetSystemDefaultLCID EnumResourceNamesA EnumResourceNamesW EnumResourceLanguagesA EnumResourceLanguagesW EnumResourceTypesA EnumResourceTypesW HeapAlloc HeapFree HeapDestroy HeapCreate GetSystemTime GetLocalTime SystemTimeToFileTime CompareFileTime GetCommandLineA GetLastError GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage GetProcAddress TlsGetValue TlsAlloc TlsSetValue TlsFree LCMapStringA LCMapStringW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent WriteFile GetStdHandle GetModuleFileNameA RaiseException Sleep ExitProcess SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetSystemTimeAsFileTime HeapReAlloc GetStringTypeA GetStringTypeW GetLocaleInfoA LoadLibraryA RtlUnwind HeapSize SetFilePointer GetConsoleCP GetConsoleMode InitializeCriticalSectionAndSpinCount SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA FlushFileBuffers VirtualQuery GetModuleFileNameW GetModuleHandleA LoadLibraryA LocalAlloc LocalFree GetModuleFileNameA ExitProcess

user32

GetKeyboardType LoadStringA MessageBoxA CharNextA CreateWindowExA WindowFromPoint WinHelpA WaitMessage UpdateWindow UnregisterClassA UnhookWindowsHookEx TranslateMessage TranslateMDISysAccel TrackPopupMenu SystemParametersInfoA ShowWindow ShowScrollBar ShowOwnedPopups ShowCursor SetWindowsHookExA SetWindowTextA SetWindowPos SetWindowPlacement SetWindowLongA SetTimer SetScrollRange SetScrollPos SetScrollInfo SetRect SetPropA SetParent SetMenuItemInfoA SetMenu SetForegroundWindow SetFocus SetCursor SetClipboardData SetClassLongA SetCapture SetActiveWindow SendMessageA ScrollWindow ScreenToClient RemovePropA RemoveMenu ReleaseDC ReleaseCapture RegisterWindowMessageA RegisterClipboardFormatA RegisterClassA RedrawWindow PtInRect PostQuitMessage PostMessageA PeekMessageA OpenClipboard OffsetRect OemToCharA MessageBoxA MessageBeep MapWindowPoints MapVirtualKeyA LoadStringA LoadKeyboardLayoutA LoadIconA LoadCursorA LoadBitmapA KillTimer IsZoomed IsWindowVisible IsWindowEnabled IsWindow IsRectEmpty IsIconic IsDialogMessageA IsChild InvalidateRect IntersectRect InsertMenuItemA InsertMenuA InflateRect GetWindowThreadProcessId GetWindowTextA GetWindowRect GetWindowPlacement GetWindowLongA GetWindowDC GetTopWindow GetSystemMetrics GetSystemMenu GetSysColorBrush GetSysColor GetSubMenu GetScrollRange GetScrollPos GetScrollInfo GetPropA GetParent GetWindow GetMenuStringA GetMenuState GetMenuItemInfoA GetMenuItemID GetMenuItemCount GetMenu GetLastActivePopup GetKeyboardState GetKeyboardLayoutList GetKeyboardLayout GetKeyState GetKeyNameTextA GetIconInfo GetForegroundWindow GetFocus GetDlgItem GetDesktopWindow GetDCEx GetDC GetCursorPos GetCursor GetClipboardData GetClientRect GetClassNameA GetClassInfoA GetCapture GetActiveWindow FrameRect FindWindowA FillRect EqualRect EnumWindows EnumThreadWindows EndPaint EndDeferWindowPos EnableWindow EnableScrollBar EnableMenuItem EmptyClipboard DrawTextA DrawMenuBar DrawIconEx DrawIcon DrawFrameControl DrawEdge DispatchMessageA DestroyWindow DestroyMenu DestroyIcon DestroyCursor DeleteMenu DeferWindowPos DefWindowProcA DefMDIChildProcA DefFrameProcA CreatePopupMenu CreateMenu CreateIcon CloseClipboard ClientToScreen CheckMenuItem CallWindowProcA CallNextHookEx BeginPaint BeginDeferWindowPos CharNextA CharLowerBuffA CharLowerA CharUpperBuffA CharToOemA AdjustWindowRectEx ActivateKeyboardLayout MessageBoxW CharUpperBuffW

advapi32

RegQueryValueExA RegOpenKeyExA RegCloseKey RegSetValueExA RegQueryValueExA RegOpenKeyExA RegCreateKeyExA RegCloseKey

oleaut32

SysFreeString SysReAllocStringLen SysAllocStringLen SafeArrayPtrOfIndex SafeArrayGetUBound SafeArrayGetLBound SafeArrayCreate VariantChangeType VariantCopy VariantClear VariantInit

version

VerQueryValueA GetFileVersionInfoSizeA GetFileVersionInfoA

gdi32

UnrealizeObject StretchBlt SetWindowOrgEx SetWinMetaFileBits SetViewportOrgEx SetTextColor SetStretchBltMode SetROP2 SetPixel SetEnhMetaFileBits SetDIBColorTable SetBrushOrgEx SetBkMode SetBkColor SelectPalette SelectObject SelectClipRgn SaveDC RestoreDC Rectangle RectVisible RealizePalette Polyline PlayEnhMetaFile PatBlt MoveToEx MaskBlt LineTo IntersectClipRect GetWindowOrgEx GetWinMetaFileBits GetTextMetricsA GetTextExtentPointA GetTextExtentPoint32A GetSystemPaletteEntries GetStockObject GetPixel GetPaletteEntries GetObjectA GetEnhMetaFilePaletteEntries GetEnhMetaFileHeader GetEnhMetaFileBits GetDeviceCaps GetDIBits GetDIBColorTable GetDCOrgEx GetCurrentPositionEx GetClipBox GetBrushOrgEx GetBitmapBits GdiFlush ExcludeClipRect DeleteObject DeleteEnhMetaFile DeleteDC CreateSolidBrush CreatePenIndirect CreatePalette CreateHalftonePalette CreateFontIndirectA CreateDIBitmap CreateDIBSection CreateCompatibleDC CreateCompatibleBitmap CreateBrushIndirect CreateBitmap CopyEnhMetaFileA BitBlt

comctl32

ImageList_SetIconSize ImageList_GetIconSize ImageList_Write ImageList_Read ImageList_GetDragImage ImageList_DragShowNolock ImageList_SetDragCursorImage ImageList_DragMove ImageList_DragLeave ImageList_DragEnter ImageList_EndDrag ImageList_BeginDrag ImageList_Remove ImageList_DrawEx ImageList_Replace ImageList_Draw ImageList_GetBkColor ImageList_SetBkColor ImageList_ReplaceIcon ImageList_Add ImageList_GetImageCount ImageList_Destroy ImageList_Create

shell32

Shell_NotifyIconA ShellExecuteA

wininet

InternetReadFile InternetOpenUrlA InternetOpenA InternetCloseHandle

comdlg32

GetOpenFileNameA

Name

CODE

Size

Virtual Size

475KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

5KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

16B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.flx0

Size

Virtual Size

546KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.flx1

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

220B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

115KB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_HEUR.Trojan.Win32.Generic.42beab0087a3df1675407f09d3d98168

kernel32

user32

advapi32

oleaut32

version

gdi32

comctl32

shell32

wininet

comdlg32

generic