jaffacakes118_not-a-virus[.]HEUR[.]AdWare[.]Win32[.]DownloadHelper[.]gen[.]f6cfc1fd305b2ee766fac013d10e6c75

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.f6cfc1fd305b2ee766fac013d10e6c75
Size 1.6MB
Sample261014-e1tttsyths
SHA256 032c66528ebdd10da710b9becc2942c6e7815c9e9ef8f1efbd8b9a6ecc1a81a5
MD5 f6cfc1fd305b2ee766fac013d10e6c75
SHA1 80816a0d20efb077e3d61945e924622de8798499
SHA512 ad087c60fdc7ca3e856a963ab9be5b24279f00b2fdb48c5d0a150bbca7d3118a41118468a94753dc7f014808b550f55747d9e467596555cb99de76f7ebb37ac1
SSDEEP 24576:ei2TJKiTsuS9fWG+vPliUcLSx8Xv4/VoNpupt4oXu+fRk8:ei2ThTsHONcDXWoXYCD
TLSH
T16385232574D3C675F0734BF38854890189387EBA67B15A83B7E42F0E4A381D3AA55EB3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.f6cfc1fd305b2ee766fac013d10e6c75

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.f6cfc1fd305b2ee766fac013d10e6c75

.exe 1.6MB

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.f6cfc1fd305b2ee766fac013d10e6c75

IMPHASH 5d64fb80544a67b95e9aa68fa2ef3955
SHA256 032c66528ebdd10da710b9becc2942c6e7815c9e9ef8f1efbd8b9a6ecc1a81a5
MD5 f6cfc1fd305b2ee766fac013d10e6c75
SHA1 80816a0d20efb077e3d61945e924622de8798499
SHA512 ad087c60fdc7ca3e856a963ab9be5b24279f00b2fdb48c5d0a150bbca7d3118a41118468a94753dc7f014808b550f55747d9e467596555cb99de76f7ebb37ac1
SSDEEP 24576:ei2TJKiTsuS9fWG+vPliUcLSx8Xv4/VoNpupt4oXu+fRk8:ei2ThTsHONcDXWoXYCD
TLSH
T16385232574D3C675F0734BF38854890189387EBA67B15A83B7E42F0E4A381D3AA55EB3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

63605

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegDeleteKeyW

kernel32

GlobalFree VirtualAlloc HeapDestroy HeapAlloc DeleteCriticalSection PulseEvent WaitForSingleObject GetSystemTime FileTimeToSystemTime lstrcmpiW lstrlenW ReadFileScatter CreateProcessW GetCommandLineW ExpandEnvironmentStringsW DeleteFileW FindNextChangeNotification GetVersionExW GetOEMCP GetCPInfo GetLocaleInfoW GetUserDefaultLCID GetConsoleWindow RaiseException EncodePointer GetLastError SetLastError GetCurrentThreadId DecodePointer ExitProcess GetModuleHandleExW GetProcAddress MultiByteToWideChar WideCharToMultiByte GetProcessHeap GetStdHandle GetFileType GetStartupInfoW GetModuleFileNameW WriteFile QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount Sleep GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW IsProcessorFeaturePresent IsDebuggerPresent IsValidCodePage GetACP EnterCriticalSection LeaveCriticalSection HeapFree LoadLibraryExW RtlUnwind OutputDebugStringW GetStringTypeW HeapReAlloc HeapSize LCMapStringW FlushFileBuffers GetConsoleCP GetConsoleMode SetStdHandle SetFilePointerEx WriteConsoleW CloseHandle CreateFileW

user32

DispatchMessageW ShowOwnedPopups IsIconic CheckRadioButton SendDlgItemMessageW GetNextDlgTabItem IsClipboardFormatAvailable ReleaseCapture KillTimer CreateMenu GetMenuItemCount SetScrollRange ShowCaret ClientToScreen GetWindowLongW TranslateMDISysAccel

winspool.drv

AddFormW

Name

.text

Size

100KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

533KB

Virtual Size

6.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1024B

Virtual Size

724B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.4ssf

Size

589KB

Virtual Size

589KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.h68uee

Size

286KB

Virtual Size

285KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.se2b

Size

149KB

Virtual Size

149KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.f6cfc1fd305b2ee766fac013d10e6c75

advapi32

kernel32

user32

winspool.drv

generic