jaffacakes118_not-a-virus[.]HEUR[.]AdWare[.]Win32[.]DownloadHelper[.]gen[.]f4d1307654a335651e7fa25849d72dac

General

Target
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.f4d1307654a335651e7fa25849d72dac
Size 2.4MB
Sample261014-e1lhfsv12r
SHA256 1a59b18e69f63035e548d3cbea6d0f0606a49834fa2dd4f75e60a6940900b5e8
MD5 f4d1307654a335651e7fa25849d72dac
SHA1 90af43ae037fa5859e4e598073caa492c7a0b6b2
SHA512 41a6417eee4139046383dbd52fa7a5d850486ad0f870d34c564bdb4bb7826ad61cc80f882f4fe7916efd5c969f109bd95e5e8cc93c913321b4e9c2e8374e2907
SSDEEP 24576:/z+CVEu3Awy611eqx5yeUmvK9covGBoX67ArdO:/L3t7VyQK9covGBoX+
TLSH
T146B5F0813F8DC11AE4A646FB4415B71932A5BC5273F5ECC367E13E1E0672AC38976A23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.f4d1307654a335651e7fa25849d72dac

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.f4d1307654a335651e7fa25849d72dac

.exe 2.4MB

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.f4d1307654a335651e7fa25849d72dac

IMPHASH 0f61354bf01da86a2907388e11ce1850
SHA256 1a59b18e69f63035e548d3cbea6d0f0606a49834fa2dd4f75e60a6940900b5e8
MD5 f4d1307654a335651e7fa25849d72dac
SHA1 90af43ae037fa5859e4e598073caa492c7a0b6b2
SHA512 41a6417eee4139046383dbd52fa7a5d850486ad0f870d34c564bdb4bb7826ad61cc80f882f4fe7916efd5c969f109bd95e5e8cc93c913321b4e9c2e8374e2907
SSDEEP 24576:/z+CVEu3Awy611eqx5yeUmvK9covGBoX67ArdO:/L3t7VyQK9covGBoX+
TLSH
T146B5F0813F8DC11AE4A646FB4415B71932A5BC5273F5ECC367E13E1E0672AC38976A23
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

41886

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegDeleteKeyW

user32

PeekMessageW GetRawInputBuffer GetTopWindow SetParent PtInRect OffsetRect FillRect DrawFocusRect ClientToScreen ShowCaret SetPropW EnableScrollBar BeginPaint SetMenuDefaultItem DeleteMenu DestroyMenu CreatePopupMenu HiliteMenuItem GetDlgCtrlID SendDlgItemMessageW GetDlgItemTextW DeferWindowPos ShowWindow DestroyWindow CreateWindowExW UnregisterClassW RegisterClassW

kernel32

CloseHandle WriteConsoleW SetFilePointerEx SetStdHandle GetConsoleMode GetConsoleCP FlushFileBuffers LCMapStringW HeapReAlloc HeapAlloc GetStringTypeW OutputDebugStringW RtlUnwind LoadLibraryExW HeapFree LeaveCriticalSection EnterCriticalSection GetCPInfo GetACP GlobalFree VirtualAlloc HeapSize GetProcessId GetCommProperties SetMailslotInfo lstrlenW CreateFileMappingW GetCommandLineW FindResourceW FindResourceExW GetTempPathW GetOEMCP WideCharToMultiByte GetLocaleInfoW EnumSystemLanguageGroupsW GetConsoleWindow IsValidCodePage IsDebuggerPresent RaiseException IsProcessorFeaturePresent EncodePointer GetLastError SetLastError GetCurrentThreadId DecodePointer ExitProcess GetModuleHandleExW GetProcAddress MultiByteToWideChar GetProcessHeap GetStdHandle GetFileType DeleteCriticalSection GetStartupInfoW GetModuleFileNameW WriteFile QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount Sleep GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW CreateFileW

winspool.drv

SetJobW

Name

.text

Size

79KB

Virtual Size

79KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

898KB

Virtual Size

7.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1024B

Virtual Size

724B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.ulr10

Size

440KB

Virtual Size

440KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.74r1h3

Size

625KB

Virtual Size

624KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

363KB

Virtual Size

362KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.f4d1307654a335651e7fa25849d72dac

advapi32

user32

kernel32

winspool.drv

generic