jaffacakes118_not-a-virus[.]HEUR[.]AdWare[.]Win32[.]DownloadHelper[.]gen[.]ef00c52370387181f8b6b0c1b314748a

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.ef00c52370387181f8b6b0c1b314748a
Size 2.0MB
Sample261014-e1epxafw2x
SHA256 a215dbf0b79c69f7324853053691b58c4ffd28386e17c80c088dfa4bf134c45b
MD5 ef00c52370387181f8b6b0c1b314748a
SHA1 2dafa7007e5bdac31b4837b08dde468c13cb8d66
SHA512 10a8698df68f2d6609c27cf7e50b5d431bf58154b78f929c209ef0fbf25d9e0838e6423ed9c727b318bb4cef11b68674b45e07d708ff14a44834ff46a36118a4
SSDEEP 12288:K5G8VdViyLykH1QHJyhArq0McdVMWKqQM1XtLEbpkR8dzhgqaNtSTaHZ0sZI7Zrs:K59PV0RDrNQUE2RGgqazSSfI5yfetk
TLSH
T1A1A5234222C3C1BAE97B9BF516245E1A92B83DC56A746CD733C12D6E2E342C76711F07
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.ef00c52370387181f8b6b0c1b314748a

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.ef00c52370387181f8b6b0c1b314748a

.exe 2.0MB

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.ef00c52370387181f8b6b0c1b314748a

IMPHASH 9eb727dc8de2a7c1ff3115eb33f78969
SHA256 a215dbf0b79c69f7324853053691b58c4ffd28386e17c80c088dfa4bf134c45b
MD5 ef00c52370387181f8b6b0c1b314748a
SHA1 2dafa7007e5bdac31b4837b08dde468c13cb8d66
SHA512 10a8698df68f2d6609c27cf7e50b5d431bf58154b78f929c209ef0fbf25d9e0838e6423ed9c727b318bb4cef11b68674b45e07d708ff14a44834ff46a36118a4
SSDEEP 12288:K5G8VdViyLykH1QHJyhArq0McdVMWKqQM1XtLEbpkR8dzhgqaNtSTaHZ0sZI7Zrs:K59PV0RDrNQUE2RGgqazSSfI5yfetk
TLSH
T1A1A5234222C3C1BAE97B9BF516245E1A92B83DC56A746CD733C12D6E2E342C76711F07
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

77886

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

wininet

InternetOpenUrlW HttpAddRequestHeadersW InternetConnectW InternetOpenW InternetCrackUrlW InternetSetOptionW

user32

DrawIconEx ClientToScreen SetCursorPos ShowCursor AdjustWindowRect SetWindowTextW GetIconInfo CheckMenuItem DestroyMenu CreateMenu GetKeyboardType CheckDlgButton IsWindow DrawEdge UpdateWindow

kernel32

lstrlenW OpenEventW FindResourceW GetVersionExW GetSystemPowerStatus GetOEMCP GetCPInfo GetStringTypeW GetCommandLineW RaiseException IsProcessorFeaturePresent EncodePointer GetLastError SetLastError GetCurrentThreadId DecodePointer ExitProcess GetModuleHandleExW GetProcAddress MultiByteToWideChar WideCharToMultiByte GetProcessHeap GetStdHandle GetFileType GetStartupInfoW GetModuleFileNameW FormatMessageW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount Sleep GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW IsDebuggerPresent IsValidCodePage GetACP EnterCriticalSection LeaveCriticalSection HeapFree LoadLibraryExW OutputDebugStringW HeapAlloc HeapReAlloc HeapSize LCMapStringW FlushFileBuffers GetConsoleCP GetConsoleMode SetStdHandle SetFilePointerEx WriteConsoleW CloseHandle CreateFileW FileTimeToLocalFileTime GetSystemTime SetCommMask GetCommProperties GetFileSize DeleteCriticalSection VirtualAlloc LocalAlloc RtlUnwind WriteFile

comctl32

InitializeFlatSB FlatSB_SetScrollInfo FlatSB_SetScrollPos CreateStatusWindowW CreateToolbarEx ImageList_SetIconSize ImageList_GetIconSize ImageList_Write ImageList_Read ImageList_GetDragImage ImageList_DragShowNolock ImageList_DragMove ImageList_DragLeave ImageList_DragEnter ImageList_GetIcon ImageList_Remove ImageList_DrawIndirect ImageList_Replace ImageList_Draw ImageList_SetBkColor ImageList_ReplaceIcon ImageList_Add ImageList_SetImageCount ImageList_GetImageCount ImageList_Destroy ImageList_Create ord17 DestroyPropertySheetPage ImageList_SetOverlayImage

psapi

GetDeviceDriverBaseNameW

advapi32

RegQueryValueExW RegDeleteValueW