jaffacakes118_not-a-virus[.]HEUR[.]AdWare[.]Win32[.]DownloadHelper[.]gen[.]f0dde10b382e10ebbf02e1ff81e0f8ca

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.f0dde10b382e10ebbf02e1ff81e0f8ca
Size 1.9MB
Sample261014-e1jnvsv12q
SHA256 3c095f96c2465776c58a04b1a729fb2a649693d51c87eca680009bf1c66db2b9
MD5 f0dde10b382e10ebbf02e1ff81e0f8ca
SHA1 b90fc4c18bfc27c8577b0866677a555eeed17808
SHA512 966c5a5e5381164b9a766770f6fdb33e7fe5a97e0ad66ec73826a718abc28c12c64ac53540d9a123fe19b95dbccce1bf49090acfc36e58ce834fb0a4a32211d1
SSDEEP 24576:CYVTEaQgIU0R6Y910HBrQkmL7thPohNhFMhFkaH:CYVQHR1/+BrQvtcqv
TLSH
T175951222B2E4C036E8B256F55CB5C57B01B47D662A64488733C23F2B7A752D3E325F29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.f0dde10b382e10ebbf02e1ff81e0f8ca

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.f0dde10b382e10ebbf02e1ff81e0f8ca

.exe 1.9MB

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.f0dde10b382e10ebbf02e1ff81e0f8ca

IMPHASH b906389efb45f6b338ffefa853468f91
SHA256 3c095f96c2465776c58a04b1a729fb2a649693d51c87eca680009bf1c66db2b9
MD5 f0dde10b382e10ebbf02e1ff81e0f8ca
SHA1 b90fc4c18bfc27c8577b0866677a555eeed17808
SHA512 966c5a5e5381164b9a766770f6fdb33e7fe5a97e0ad66ec73826a718abc28c12c64ac53540d9a123fe19b95dbccce1bf49090acfc36e58ce834fb0a4a32211d1
SSDEEP 24576:CYVTEaQgIU0R6Y910HBrQkmL7thPohNhFMhFkaH:CYVQHR1/+BrQvtcqv
TLSH
T175951222B2E4C036E8B256F55CB5C57B01B47D662A64488733C23F2B7A752D3E325F29
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

69939

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegQueryValueExW OpenSCManagerW RegOpenKeyExW

kernel32

GetVersion GlobalLock VirtualAlloc HeapReAlloc GetCurrentProcessId GetLastError InitializeCriticalSectionAndSpinCount GetLocalTime SystemTimeToFileTime lstrlenW CreateEventW LoadLibraryExW GetModuleHandleW GetCommandLineW FindResourceExW GetFileAttributesExW CancelIo GetCPInfo GetUserDefaultLangID GetUserDefaultLCID EnumSystemCodePagesW CloseHandle WriteConsoleW SetFilePointerEx SetStdHandle GetConsoleMode GetConsoleCP FlushFileBuffers LCMapStringW HeapSize HeapAlloc GetStringTypeW OutputDebugStringW RtlUnwind HeapFree LeaveCriticalSection RaiseException EncodePointer SetLastError GetCurrentThreadId DecodePointer ExitProcess GetModuleHandleExW GetProcAddress MultiByteToWideChar WideCharToMultiByte GetProcessHeap GetStdHandle GetFileType DeleteCriticalSection GetStartupInfoW GetModuleFileNameW WriteFile QueryPerformanceCounter GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter Sleep GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree IsProcessorFeaturePresent IsDebuggerPresent IsValidCodePage GetACP GetOEMCP EnterCriticalSection CreateFileW

user32

CloseDesktop RegisterWindowMessageW PeekMessageW DestroyWindow GetDlgItemInt CopyAcceleratorTableW LoadMenuW RemoveMenu CopyImage FindWindowExW SetParent DrawFocusRect SetActiveWindow UpdateWindow

urlmon

CoInternetCreateSecurityManager RegisterBindStatusCallback

wintrust

WTHelperProvDataFromStateData CryptCATCatalogInfoFromContext CryptCATAdminCalcHashFromFileHandle WinVerifyTrust CryptCATAdminEnumCatalogFromHash

generic

count=2, id=228, version=40629,

count=5, id=199, version=41118,

count=3, id=206, version=65501,

count=2, id=208, version=65501,

count=26, id=203, version=65501,

count=2, id=221, productName=VS2013 UPD3 build 30723, version=30723,

count=33, productName=Unmarked objects (old),

count=621, id=1, productName=Unmarked objects,

count=3, id=221, productName=VS2013 build 21005, version=21005,

count=18, id=223, productName=VS2013 build 21005, version=21005,

count=21, id=224, productName=VS2013 build 21005, version=21005,

count=2, id=225, productName=VS2013 build 21005, version=21005,

count=219, id=224, productName=VS2013 UPD3 build 30723, version=30723,

count=2, id=225, productName=VS2013 UPD5 build 40629, version=40629,

count=638, id=224, productName=VS2013 UPD5 build 40629, version=40629,

count=1, id=219, productName=VS2013 build 21005, version=21005,

count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,