jaffacakes118_not-a-virus[.]HEUR[.]AdWare[.]Win32[.]Generic[.]46f58bde1db89dc1f08e1f7d492328cb

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.46f58bde1db89dc1f08e1f7d492328cb
Size 581KB
Sample261014-e4ybesyvbx
SHA256 02d94b291fbe35374db1082acaf82cae7ae35eb80fdf8ace73686cb72cd222ed
MD5 46f58bde1db89dc1f08e1f7d492328cb
SHA1 1ec0a8eadf6d75dea07c51b87a94401560044a7d
SHA512 bcfebf5fea6d4a44cb1488158b0f1550007240811b4fb24a92665beb5a49158cf73b4e2d41c3caefdd4ed06a8514a30f0f73b7a5bfaf658bd3b281b1503e7938
SSDEEP 12288:ImWWoBtTyOS2cDk00oPewHOaZyq1M//0Q0cGHw8b:+BoOS2cDk00GpHzyq1M/s1J
TLSH
T128C47E27E346F367E1F208F26E5FA37640795B35F12C4616A3940B1AAA607E0722537F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.46f58bde1db89dc1f08e1f7d492328cb

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.46f58bde1db89dc1f08e1f7d492328cb

.exe 581KB

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.46f58bde1db89dc1f08e1f7d492328cb

IMPHASH 3466c0e0f9dbc4d8fc0b520bd03f0cc5
SHA256 02d94b291fbe35374db1082acaf82cae7ae35eb80fdf8ace73686cb72cd222ed
MD5 46f58bde1db89dc1f08e1f7d492328cb
SHA1 1ec0a8eadf6d75dea07c51b87a94401560044a7d
SHA512 bcfebf5fea6d4a44cb1488158b0f1550007240811b4fb24a92665beb5a49158cf73b4e2d41c3caefdd4ed06a8514a30f0f73b7a5bfaf658bd3b281b1503e7938
SSDEEP 12288:ImWWoBtTyOS2cDk00oPewHOaZyq1M//0Q0cGHw8b:+BoOS2cDk00GpHzyq1M/s1J
TLSH
T128C47E27E346F367E1F208F26E5FA37640795B35F12C4616A3940B1AAA607E0722537F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

e9:7d:43:27:29:18:8b:85:a1:6a:8b:b6:3f:6e:64:38:37:6d:64:f6

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Freemium GmbH,O=Freemium GmbH,POSTALCODE=10119,STREET=Schwedter Straße 9A,L=Berlin,ST=Berlin,C=DE

Chains

Oct 7, 2026

CN=Freemium GmbH,O=Freemium GmbH,POSTALCODE=10119,STREET=Schwedter Straße 9A,L=Berlin,ST=Berlin,C=DE

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

CN=Freemium GmbH,O=Freemium GmbH,POSTALCODE=10119,STREET=Schwedter Straße 9A,L=Berlin,ST=Berlin,C=DE

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

CN=Freemium GmbH,O=Freemium GmbH,POSTALCODE=10119,STREET=Schwedter Straße 9A,L=Berlin,ST=Berlin,C=DE

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Serial Number

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 30, 2000 - May 30, 2020

Subject

CN=Freemium GmbH,O=Freemium GmbH,POSTALCODE=10119,STREET=Schwedter Straße 9A,L=Berlin,ST=Berlin,C=DE

Serial Number

48:ec:05:2d:ad:94:98:23:d9:66:e3:f7:7e:c8:1e:59

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 23, 2018 - May 23, 2019

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 30, 2000 - May 30, 2020

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 9, 2013 - May 8, 2028

Minor OS version

Major OS version

Entry point

83228

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

DeleteCriticalSection InitializeCriticalSectionAndSpinCount LocalAlloc LoadLibraryA InitializeCriticalSection CreateEventW FlushFileBuffers CopyFileW CreateFileMappingW GlobalAlloc GlobalFree HeapFree GetFileInformationByHandle FindClose GetFullPathNameW FindFirstFileW FindNextFileW DebugBreak OutputDebugStringW lstrlenA LoadLibraryW MulDiv lstrcmpW GlobalUnlock GlobalLock CloseHandle CreateFileW ReadFile WriteConsoleW SetStdHandle LCMapStringW GetConsoleMode GetConsoleCP WideCharToMultiByte SetFilePointer InterlockedIncrement RtlUnwind GetCurrentProcessId GetTickCount QueryPerformanceCounter GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetStringTypeW IsValidCodePage GetOEMCP GetACP GetCPInfo TlsFree TlsSetValue TlsGetValue TlsAlloc GetStdHandle WriteFile HeapReAlloc HeapCreate ExitProcess HeapSize Sleep IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess GetStartupInfoW HeapSetInformation GetCommandLineW GetSystemTimeAsFileTime DecodePointer EncodePointer InterlockedPopEntrySList VirtualAlloc VirtualFree InterlockedDecrement GetModuleFileNameW LoadLibraryExW FindResourceW LoadResource SizeofResource MultiByteToWideChar lstrlenW lstrcmpiW FreeLibrary SetLastError GetLastError RaiseException GetCurrentThreadId FlushInstructionCache GetCurrentProcess GetModuleHandleW GetProcAddress LeaveCriticalSection EnterCriticalSection IsProcessorFeaturePresent HeapAlloc GetProcessHeap InterlockedPushEntrySList InterlockedCompareExchange

user32

GetClassInfoExW KillTimer LoadCursorW CreateWindowExW DestroyWindow SetTimer RegisterClassExW DefWindowProcW GetWindowLongW CallWindowProcW SetWindowLongW InvalidateRect RegisterWindowMessageW BeginPaint FillRect EndPaint IsChild SetFocus GetDlgItem GetClassNameW GetSysColor RedrawWindow CreateAcceleratorTableW UnregisterClassA GetDesktopWindow GetFocus UpdateWindow SetWindowTextW GetWindowTextW GetWindowTextLengthW ClientToScreen ReleaseDC GetDC PostMessageW ShowWindow IsWindowVisible GetWindow MonitorFromWindow GetMonitorInfoW GetParent GetClientRect MapWindowPoints SetWindowPos MoveWindow GetWindowRect IsWindow SendMessageW LoadImageW MessageBoxW SendMessageTimeoutW PeekMessageW GetMessageW TranslateMessage DispatchMessageW CharNextW

gdi32

GetStockObject GetDeviceCaps GetObjectW SelectObject CreateCompatibleDC DeleteDC DeleteObject CreateSolidBrush

comdlg32

GetOpenFileNameW

advapi32

RegQueryInfoKeyW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegSetValueExW RegQueryValueExW RegCreateKeyExW RegOpenKeyExW RegCloseKey

shell32

DoEnvironmentSubstW

ole32

CoCreateInstance CoTaskMemFree CoTaskMemRealloc OleInitialize CreateStreamOnHGlobal OleLockRunning OleUninitialize StringFromCLSID CLSIDFromProgID CoTaskMemAlloc

oleaut32

LoadRegTypeLi SysStringLen OleCreateFontIndirect DispCallFunc VarBstrCat SysStringByteLen SysAllocStringByteLen LoadTypeLi SysFreeString VariantInit VariantClear VariantChangeType SysAllocString VariantCopy VarUI4FromStr

shlwapi

PathAddBackslashW PathRemoveFileSpecW PathFileExistsW

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.46f58bde1db89dc1f08e1f7d492328cb

PE Signature issue

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

generic