jaffacakes118_not-a-virus[.]HEUR[.]AdWare[.]Win32[.]DownloadHelper[.]gen[.]f50135912bfdc5e5a3d13c1364aa0070

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.f50135912bfdc5e5a3d13c1364aa0070
Size 2.1MB
Sample261014-e1p6msytgx
SHA256 004a1ee59642ca52dc92d9bcd07baf77be9dcc221e80dc008ad8354a3e7113b1
MD5 f50135912bfdc5e5a3d13c1364aa0070
SHA1 fd930e959fd2c90e8b20a8bb2a7b7bfca9098c88
SHA512 7a4eb5fdedbc50707d1a9f7a53309938222bbff624a8aa74a5b782263b48e60ce25a838568cc71bf9c305b4256a4365dbee34c6bcedc38c6b00ae8e355492bbf
SSDEEP 24576:V/i+X6wHMMo2ZE8s3CnUnC2Rkj/HgaT2SUoXIiNt3:V//QMo6nUFR7SNJ
TLSH
T183A523413A93C0B8E1E365B34479E61925383EA46A709C97BFD26E0D88341D3E395EB7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.f50135912bfdc5e5a3d13c1364aa0070

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.f50135912bfdc5e5a3d13c1364aa0070

.exe 2.1MB

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.f50135912bfdc5e5a3d13c1364aa0070

IMPHASH 84de11bd8b0ce85bdc3fd082d360c89f
SHA256 004a1ee59642ca52dc92d9bcd07baf77be9dcc221e80dc008ad8354a3e7113b1
MD5 f50135912bfdc5e5a3d13c1364aa0070
SHA1 fd930e959fd2c90e8b20a8bb2a7b7bfca9098c88
SHA512 7a4eb5fdedbc50707d1a9f7a53309938222bbff624a8aa74a5b782263b48e60ce25a838568cc71bf9c305b4256a4365dbee34c6bcedc38c6b00ae8e355492bbf
SSDEEP 24576:V/i+X6wHMMo2ZE8s3CnUnC2Rkj/HgaT2SUoXIiNt3:V//QMo6nUFR7SNJ
TLSH
T183A523413A93C0B8E1E365B34479E61925383EA46A709C97BFD26E0D88341D3E395EB7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

50132

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegQueryValueExW

user32

DialogBoxParamW CreateWindowExW GetClassInfoW DispatchMessageW CharPrevW GetDlgCtrlID DdeCreateDataHandle EnumDisplayMonitors GetIconInfo CopyIcon DrawIconEx LoadIconW IsRectEmpty InflateRect SetRect GetCursor MessageBoxW AdjustWindowRectEx GetClientRect GetWindowTextLengthW GetWindowTextW SetWindowTextW RemovePropW EnableScrollBar GetScrollPos RedrawWindow AllowSetForegroundWindow UpdateWindow TrackPopupMenuEx TrackPopupMenu GetSubMenu CreateMenu DrawMenuBar GetMenu LoadMenuW

secur32

InitializeSecurityContextW DeleteSecurityContext FreeContextBuffer GetUserNameExW FreeCredentialsHandle

winspool.drv

EnumPrinterDataExW GetPrintProcessorDirectoryW

kernel32

CloseHandle WriteConsoleW SetFilePointerEx SetStdHandle GetConsoleMode GetConsoleCP FlushFileBuffers LCMapStringW HeapSize HeapReAlloc HeapAlloc OutputDebugStringW RtlUnwind HeapFree LeaveCriticalSection EnterCriticalSection GetCPInfo GetOEMCP GetACP IsValidCodePage IsDebuggerPresent IsProcessorFeaturePresent TlsFree TlsSetValue TlsGetValue TlsAlloc TerminateProcess GetCurrentProcess Sleep InitializeCriticalSectionAndSpinCount SetUnhandledExceptionFilter UnhandledExceptionFilter FreeEnvironmentStringsW GetEnvironmentStringsW VirtualAlloc GetProcessId DeleteCriticalSection SetHandleCount WriteFile GetFileTime MulDiv GetSystemTime FileTimeToSystemTime CreateFileMappingW LoadLibraryW LoadLibraryExW GetModuleHandleW GetStartupInfoW FindResourceW GetProfileIntW GetSystemDirectoryW FindFirstFileW WideCharToMultiByte CompareStringW GetUserDefaultLCID GetStringTypeW GetConsoleWindow GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter GetModuleFileNameW GetCommandLineW RaiseException EncodePointer GetLastError SetLastError GetCurrentThreadId DecodePointer ExitProcess GetModuleHandleExW GetProcAddress MultiByteToWideChar GetProcessHeap GetStdHandle GetFileType CreateFileW

ole32

CoTaskMemAlloc PropVariantClear CLSIDFromProgID

Name

.text

Size

87KB

Virtual Size

87KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

781KB

Virtual Size

7.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1024B

Virtual Size

724B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.y464

Size

180KB

Virtual Size

179KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.f3aatf

Size

734KB

Virtual Size

734KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.en18

Size

374KB

Virtual Size

373KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.f50135912bfdc5e5a3d13c1364aa0070

advapi32

user32

secur32

winspool.drv

kernel32

ole32

generic