jaffacakes118_HEUR[.]Trojan[.]Win32[.]Generic[.]4f8fc2203d3f1705ffc8234827ee7011

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.4f8fc2203d3f1705ffc8234827ee7011
Size 625KB
Sample261014-dpafdaec43
SHA256 437da2359c588107e3aa386c74b117aaccaabfef67e77a3a0f2cfa648fa41828
MD5 4f8fc2203d3f1705ffc8234827ee7011
SHA1 b45315d65748af186073c45a428a8a53a92cdbe4
SHA512 291828c202c9b1422e45b27a53354edcdb138b5f63a52e2cf3cf271cbcf12dd0e7a532a8e339f6b613e2ce7836388956e533569b62ecbd7081a46814752edc84
SSDEEP 12288:4RD0IgMPoaIlSIMU85N68IAQuChoRge+E6:4RIzMPoll/b868I9uMoRg8
TLSH
T1C8D401145290EC9AF865F77164830FFDE0E0BB309A63D12AEB487C9CD17718549EDB8A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_HEUR.Trojan.Win32.Generic.4f8fc2203d3f1705ffc8234827ee7011

File Explorer

jaffacakes118_HEUR.Trojan.Win32.Generic.4f8fc2203d3f1705ffc8234827ee7011

.dll 625KB

jaffacakes118_HEUR.Trojan.Win32.Generic.4f8fc2203d3f1705ffc8234827ee7011

IMPHASH 2c304f1ba1ef7e8e82557555be75711b
SHA256 437da2359c588107e3aa386c74b117aaccaabfef67e77a3a0f2cfa648fa41828
MD5 4f8fc2203d3f1705ffc8234827ee7011
SHA1 b45315d65748af186073c45a428a8a53a92cdbe4
SHA512 291828c202c9b1422e45b27a53354edcdb138b5f63a52e2cf3cf271cbcf12dd0e7a532a8e339f6b613e2ce7836388956e533569b62ecbd7081a46814752edc84
SSDEEP 12288:4RD0IgMPoaIlSIMU85N68IAQuChoRge+E6:4RIzMPoll/b868I9uMoRg8
TLSH
T1C8D401145290EC9AF865F77164830FFDE0E0BB309A63D12AEB487C9CD17718549EDB8A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

12428

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

lpdsbycu.9af

kernel32

LCMapStringW IsBadWritePtr TerminateProcess VirtualQuery GetFileType CreateTimerQueueTimer ReleaseMutex GetACP DisconnectNamedPipe WriteFile ConnectNamedPipe GetModuleHandleA IsBadCodePtr GetSystemInfo FreeEnvironmentStringsW InterlockedExchangeAdd InitializeCriticalSection InterlockedDecrement VirtualProtect SetEvent HeapAlloc GetCPInfo GetLocaleInfoA GetCurrentProcessId WaitForSingleObject IsBadReadPtr SetUnhandledExceptionFilter GetStdHandle InterlockedExchange GetModuleFileNameA GetCurrentThreadId WideCharToMultiByte DuplicateHandle GetVersionExA LoadLibraryA CreateEventA GetTickCount GetLastError ResetEvent CreateNamedPipeA UnmapViewOfFile LeaveCriticalSection GetSystemTimeAsFileTime DeleteCriticalSection CreateMutexW GetOEMCP HeapDestroy LCMapStringA CreateThread GetEnvironmentStrings GetEnvironmentStringsW DeleteTimerQueueTimer OpenProcess RtlUnwind SetLastError WaitForMultipleObjects HeapFree InterlockedCompareExchange UnhandledExceptionFilter QueryPerformanceCounter GetStartupInfoA MultiByteToWideChar lstrcpyW FreeEnvironmentStringsA ExitThread GetBinaryTypeA lstrcatW Sleep EnterCriticalSection

user32

LoadIconA DrawIcon CreateIconFromResource wsprintfW

advapi32

InitializeSecurityDescriptor SetSecurityDescriptorDacl

msvcrt

_stricmp _strnicmp _wcsnset wcsstr fprintf fflush realloc wcsncmp wcstol wcstod calloc _wtoi _ltow wcstok malloc free wcslen wcschr swprintf wcscmp fgetws wcscat wcscpy isdigit exit vwprintf strtok towupper wprintf printf memmove memset memcpy scanf

Sharing