jaffacakes118_HEUR[.]Trojan[.]Win32[.]Generic[.]50a739deaad5c809df8a5bafa1b972fc

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.50a739deaad5c809df8a5bafa1b972fc
Size 172KB
Sample261014-dqlj2aey61
SHA256 5de474bcdd5e169d808b0ec994c3a1bae75414e5bb6a0116d21b2ad2a97efa35
MD5 50a739deaad5c809df8a5bafa1b972fc
SHA1 3b25754afaef38dcad3992cebcbbc56ba3d6b538
SHA512 aba06a3e17b0d4b9a4f586b91a445267c2f2193d31fccdcbcda18e5810448c468fae4e7cc21aa90c151454409b7633a87b473735df868c5a2d0599d756c0ff11
SSDEEP 1536:YIQyFs7GZ6f0zW9qM3790RaOteOfbhbZfwerVnlZExtn7JTfPg:YbzfXR37m9sWxDZktn7JL4
TLSH
T103047A28A90DBC64CC8778B08E5712B3D41DB6EFAB0C61D6AADF951914736D0EF280DD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_HEUR.Trojan.Win32.Generic.50a739deaad5c809df8a5bafa1b972fc

File Explorer

jaffacakes118_HEUR.Trojan.Win32.Generic.50a739deaad5c809df8a5bafa1b972fc

.exe 172KB

jaffacakes118_HEUR.Trojan.Win32.Generic.50a739deaad5c809df8a5bafa1b972fc

IMPHASH c6fa1ae7151a16cbd2f0f455bac3b09e
SHA256 5de474bcdd5e169d808b0ec994c3a1bae75414e5bb6a0116d21b2ad2a97efa35
MD5 50a739deaad5c809df8a5bafa1b972fc
SHA1 3b25754afaef38dcad3992cebcbbc56ba3d6b538
SHA512 aba06a3e17b0d4b9a4f586b91a445267c2f2193d31fccdcbcda18e5810448c468fae4e7cc21aa90c151454409b7633a87b473735df868c5a2d0599d756c0ff11
SSDEEP 1536:YIQyFs7GZ6f0zW9qM3790RaOteOfbhbZfwerVnlZExtn7JTfPg:YbzfXR37m9sWxDZktn7JL4
TLSH
T103047A28A90DBC64CC8778B08E5712B3D41DB6EFAB0C61D6AADF951914736D0EF280DD
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

20336

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

DuplicateHandle GetCurrentProcess OpenProcess WriteFile CreateFileA Sleep WinExec GetModuleFileNameA SetFileTime GetSystemDirectoryA GetVersionExA WideCharToMultiByte FreeLibrary TerminateProcess WaitForSingleObject CreateProcessA GetStartupInfoA GetModuleHandleA LoadLibraryA CloseHandle GetProcAddress GetLastError GetFileAttributesExA

user32

ShowWindow RegisterClassExA CreateWindowExA DefWindowProcA PostQuitMessage SendMessageTimeoutA RegisterWindowMessageA GetClassNameA PostMessageA EnumChildWindows GetWindowThreadProcessId EnumWindows DispatchMessageA GetDesktopWindow TranslateMessage GetMessageA

advapi32

LookupAccountNameA OpenSCManagerA DeleteService OpenServiceA RegCloseKey RegQueryValueExA RegOpenKeyExA CreateServiceA StartServiceA ConvertSidToStringSidA GetUserNameA CloseServiceHandle

shell32

SHGetSpecialFolderPathA

ole32

CoInitialize CoUninitialize

oleaut32

SysFreeString VariantClear

shlwapi

SHGetValueA SHSetValueA

msvcrt

wcslen _stricmp _controlfp _except_handler3 __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _acmdln exit _XcptFilter _exit fopen fwrite fflush fclose __CxxFrameHandler strstr strchr atoi _strlwr rand sprintf _access srand time ??3@YAXPAX@Z ??2@YAPAXI@Z

dbghelp

ImageNtHeader

Name

.text

Size

20KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

116KB

Virtual Size

113KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

odata

Size

4KB

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

ndata

Size

4KB

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

mdata

Size

4KB

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

edata

Size

4KB

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

cdata

Size

4KB

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

idata

Size

4KB

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_HEUR.Trojan.Win32.Generic.50a739deaad5c809df8a5bafa1b972fc

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

msvcrt

dbghelp

generic