jaffacakes118_HEUR[.]Trojan[.]Win32[.]Generic[.]4d2e7b767d4771465fc51517c28a71e4

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.4d2e7b767d4771465fc51517c28a71e4
Size 128KB
Sample261014-dfphyaec25
SHA256 38ea7a813d7f3fec2f22bb78559e64970a8bf1f79698f9a7d865df71250f3211
MD5 4d2e7b767d4771465fc51517c28a71e4
SHA1 8615bd740be04ae9612688fbac965bffbcf407e8
SHA512 1cb583638dada967600ed7b7e9ad9a39eae2a18bf6e39bd7412451a04308b641c0578849e8d572d3dfe5557a8fa67cdb0e14fa60cefd4785708d47e4ed52ee04
SSDEEP 3072:lQYY7/GJlsrT+ieoIYyRzHYUKohkcLQ61qbGHOL5PFn0wcccccccc:jYbZ/tyRzHYUK+kcLzH0PFn0wccccccz
TLSH
T151D3BE902287C5BBCE888971F41B97F86F717CA5DC3AC61797B27E66B832621DDC2044
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_HEUR.Trojan.Win32.Generic.4d2e7b767d4771465fc51517c28a71e4

File Explorer

jaffacakes118_HEUR.Trojan.Win32.Generic.4d2e7b767d4771465fc51517c28a71e4

.dll 128KB

jaffacakes118_HEUR.Trojan.Win32.Generic.4d2e7b767d4771465fc51517c28a71e4

IMPHASH 5ac28fc69c9f02e9177ee65f3c9c82fb
SHA256 38ea7a813d7f3fec2f22bb78559e64970a8bf1f79698f9a7d865df71250f3211
MD5 4d2e7b767d4771465fc51517c28a71e4
SHA1 8615bd740be04ae9612688fbac965bffbcf407e8
SHA512 1cb583638dada967600ed7b7e9ad9a39eae2a18bf6e39bd7412451a04308b641c0578849e8d572d3dfe5557a8fa67cdb0e14fa60cefd4785708d47e4ed52ee04
SSDEEP 3072:lQYY7/GJlsrT+ieoIYyRzHYUKohkcLQ61qbGHOL5PFn0wcccccccc:jYbZ/tyRzHYUK+kcLzH0PFn0wccccccz
TLSH
T151D3BE902287C5BBCE888971F41B97F86F717CA5DC3AC61797B27E66B832621DDC2044
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

18568

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

DisableThreadLibraryCalls ExitProcess FindResourceA GetACP GetCommandLineA GetModuleHandleA GetOEMCP GetStartupInfoA GetSystemDirectoryA GetVersionExA HeapAlloc SetLastError SetUnhandledExceptionFilter TlsGetValue VirtualAlloc VirtualFree lstrcmpiA lstrcpyA lstrcpynA lstrlenA

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

ntdll

RtlLockHeap RtlNtStatusToDosError RtlOpenCurrentUser RtlUnlockHeap strstr NtEnumerateKey NtEnumerateValueKey NtMakeTemporaryObject NtOpenThreadToken RtlCreateSecurityDescriptor RtlExpandEnvironmentStrings_U RtlInitString RtlInitUnicodeString RtlLeaveCriticalSection RtlInitializeCriticalSection

rpcrt4

char_array_from_ndr data_into_ndr UuidIsNil short_from_ndr_temp tree_peek_ndr RpcSsEnableAllocate RpcSmSetThreadHandle RpcSmGetThreadHandle RpcSmDestroyClientContext RpcServerUseAllProtseqs RpcServerTestCancel RpcServerRegisterAuthInfoA RpcBindingSetAuthInfoA MesDecodeIncrementalHandleCreate enum_from_ndr

crtdll

wcstombs wcstok vfwprintf raise isxdigit isprint gmtime fwrite _ungetch _isctype _isatty _getdllprocaddr _copysign

Sharing