jaffacakes118_not-a-virus[.]HEUR[.]AdWare[.]Win32[.]DownloadHelper[.]gen[.]f4dc109a98b716ae2b0bc1d90c8637b2

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.f4dc109a98b716ae2b0bc1d90c8637b2
Size 1.8MB
Sample261014-e1nb2sytgv
SHA256 90a79d11e12d0f7cd386f798d7c680ec2f027046e830f3af3f5c55ccf89305b6
MD5 f4dc109a98b716ae2b0bc1d90c8637b2
SHA1 84ce94871a31140ecd123231838531bf05dd05ae
SHA512 a15828d59eb6dd344e99f84f360ccde195ad6acf99e34b8b71119fa573edde0459e1659ba8ac1d92b402196ffddcf7c192ca14513669e206030bbcf4789f7104
SSDEEP 24576:wliNA83nogILXgpi8U2BeDCF144FkPHQ8fZH8SQwNbmj/lb:wlfX0GO4TSSQwN6J
TLSH
T15F95230232D2E0B0E5FF45F206719956663D7C6A4D30588F32D8AA1FACB42D3DB31E5A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.f4dc109a98b716ae2b0bc1d90c8637b2

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.f4dc109a98b716ae2b0bc1d90c8637b2

.exe 1.8MB

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.f4dc109a98b716ae2b0bc1d90c8637b2

IMPHASH db4b471f58ad766a08a37d47dd9b9ce0
SHA256 90a79d11e12d0f7cd386f798d7c680ec2f027046e830f3af3f5c55ccf89305b6
MD5 f4dc109a98b716ae2b0bc1d90c8637b2
SHA1 84ce94871a31140ecd123231838531bf05dd05ae
SHA512 a15828d59eb6dd344e99f84f360ccde195ad6acf99e34b8b71119fa573edde0459e1659ba8ac1d92b402196ffddcf7c192ca14513669e206030bbcf4789f7104
SSDEEP 24576:wliNA83nogILXgpi8U2BeDCF144FkPHQ8fZH8SQwNbmj/lb:wlfX0GO4TSSQwN6J
TLSH
T15F95230232D2E0B0E5FF45F206719956663D7C6A4D30588F32D8AA1FACB42D3DB31E5A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

31940

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LocalAlloc LocalFree VirtualAlloc HeapDestroy HeapAlloc ExitProcess LeaveCriticalSection SetFilePointer GetLocalTime lstrcmpiW CreateMutexW GetModuleFileNameW OutputDebugStringW FindResourceW GetDriveTypeW GetFileAttributesW BuildCommDCBAndTimeoutsW MultiByteToWideChar GetStringTypeW GetConsoleWindow CloseHandle WriteConsoleW SetFilePointerEx SetStdHandle GetConsoleMode GetConsoleCP FlushFileBuffers LCMapStringW HeapSize HeapReAlloc RtlUnwind LoadLibraryExW HeapFree EnterCriticalSection GetCPInfo GetOEMCP GetACP IsValidCodePage GetCommandLineW RaiseException EncodePointer GetLastError SetLastError GetCurrentThreadId DecodePointer GetModuleHandleExW GetProcAddress WideCharToMultiByte GetProcessHeap GetStdHandle GetFileType DeleteCriticalSection GetStartupInfoW WriteFile QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount Sleep GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW IsProcessorFeaturePresent IsDebuggerPresent CreateFileW

user32

IsRectEmpty CopyRect GetCursorPos EnumPropsExW GetUpdateRect DrawTextW TrackPopupMenuEx CreatePopupMenu GetMenu GetSystemMetrics GetFocus IsClipboardFormatAvailable IsZoomed SystemParametersInfoW

oleaut32

LoadTypeLi VarNot VarBstrFromBool VarDateFromStr VariantChangeTypeEx VariantChangeType VariantCopyInd SafeArrayPtrOfIndex SafeArrayUnaccessData SafeArrayAccessData SafeArrayGetLBound SysFreeString

Name

.text

Size

69KB

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

732KB

Virtual Size

7.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1024B

Virtual Size

724B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.2eru

Size

662KB

Virtual Size

661KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.7a205

Size

277KB

Virtual Size

277KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.7triln

Size

104KB

Virtual Size

104KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

generic

count=10, id=223, productName=VS2013 build 21005, version=21005,

count=20, id=224, productName=VS2013 build 21005, version=21005,

count=4, id=221, productName=VS2013 build 21005, version=21005,

count=9, id=225, productName=VS2013 build 21005, version=21005,

count=2, id=221, productName=VS2013 UPD5 build 40629, version=40629,

count=2, id=206, version=65501,

count=1, id=208, version=65501,

count=17, id=203, version=65501,

count=284, id=1, productName=Unmarked objects,

count=6, id=225, version=20806,

count=17, id=125, productName=VS2005 build 50727, version=50727,

count=98, id=109, productName=VS2005 build 50727, version=50727,

count=27, id=225, productName=VS2013 UPD5 build 40629, version=40629,

count=1, id=224, productName=VS2013 UPD5 build 40629, version=40629,

count=1, id=219, productName=VS2013 build 21005, version=21005,

count=1, id=151,

count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,