jaffacakes118_not-a-virus[.]HEUR[.]AdWare[.]Win32[.]Generic[.]4f41b65fa7d85d10efaa1e9aa24c9857

General

Target
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.4f41b65fa7d85d10efaa1e9aa24c9857
Size 1.6MB
Sample261014-e43adayvbz
SHA256 8f225a13a924f2524bb202195e92141c301bc409efd54324dfb918c51a1278ee
MD5 4f41b65fa7d85d10efaa1e9aa24c9857
SHA1 ceb063fb7be20ecdb9a61db9a5372a753926cab4
SHA512 ce9651ca6a1209c519b01af2033daba71db41e6df4ce60e919eb0895f784787575a47e13902431fabc13782292b06188e0cb9d15707e2514ad7cfc9d01a78e95
SSDEEP 12288:KtyqEEYkvSRDjNiIYNlSeHFBXM99KsEQccWncIPL/I/wuAy:UylTkvUjMIDecSsEnrncIL/w
TLSH
T107750103B5A3FC72D8621A31D491CD70D83A74107620CD6BA25B07FEDEAC1C45AF5AAB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.4f41b65fa7d85d10efaa1e9aa24c9857

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.4f41b65fa7d85d10efaa1e9aa24c9857

.exe 1.6MB

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.4f41b65fa7d85d10efaa1e9aa24c9857

IMPHASH 44efd11d47c05295e3d4d01a3c1bfd26
SHA256 8f225a13a924f2524bb202195e92141c301bc409efd54324dfb918c51a1278ee
MD5 4f41b65fa7d85d10efaa1e9aa24c9857
SHA1 ceb063fb7be20ecdb9a61db9a5372a753926cab4
SHA512 ce9651ca6a1209c519b01af2033daba71db41e6df4ce60e919eb0895f784787575a47e13902431fabc13782292b06188e0cb9d15707e2514ad7cfc9d01a78e95
SSDEEP 12288:KtyqEEYkvSRDjNiIYNlSeHFBXM99KsEQccWncIPL/I/wuAy:UylTkvUjMIDecSsEnrncIL/w
TLSH
T107750103B5A3FC72D8621A31D491CD70D83A74107620CD6BA25B07FEDEAC1C45AF5AAB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

5069

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

VirtualProtect GetModuleHandleW GetFileInformationByHandle SetFileInformationByHandle AddSecureMemoryCacheCallback CreateMemoryResourceNotification GetApplicationRecoveryCallback GetFinalPathNameByHandleW GetMaximumProcessorGroupCount GetNamedPipeClientComputerNameW CreateFileW DecodePointer WriteConsoleW SetFilePointerEx UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwind GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameW MultiByteToWideChar WideCharToMultiByte ExitProcess GetModuleHandleExW GetACP HeapFree HeapAlloc CloseHandle FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW SetStdHandle GetFileType GetStringTypeW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers GetConsoleCP GetConsoleMode RaiseException

user32

ChangeWindowMessageFilterEx CalculatePopupWindowPosition GetWindowModuleFileNameW AddClipboardFormatListener

Sharing