jaffacakes118_not-a-virus[.]HEUR[.]AdWare[.]Win32[.]Generic[.]5142b8f5a5c54a3891e994f7f4aef9c7

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.5142b8f5a5c54a3891e994f7f4aef9c7
Size 1.3MB
Sample261014-e5mw3sf19q
SHA256 1aef0eb9e6ab727f32858022693acdc9ba12fef760de8196348b631be8b27246
MD5 5142b8f5a5c54a3891e994f7f4aef9c7
SHA1 ac84a9b4ea3a4e67acebc6eb6949fb79b9baac0d
SHA512 46fc42cd15a2632eb372768e00ba5871e67f0b37207db0f5500338b4f658a9d22d9a01cfb2cf9bf0453a60284b30df604d9d4130de875ed11eb239e1786291eb
SSDEEP 24576:LKfN6hWZPJIxaWScX7B27Mvr53f14iB7uRUfNfkJLD2aXGtXWgXm7lRERI:LKfUkI0c4Aci918F6aXGtBMERI
TLSH
T18B559C1225E1B976D0724E31AB7B97DC821DAF132B57C9DFE2D41C4B4A7C1827B312A2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.5142b8f5a5c54a3891e994f7f4aef9c7

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.5142b8f5a5c54a3891e994f7f4aef9c7

.exe 1.3MB

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.5142b8f5a5c54a3891e994f7f4aef9c7

IMPHASH 33c7f71756cbfdbd5a2c1818d73dc2f4
SHA256 1aef0eb9e6ab727f32858022693acdc9ba12fef760de8196348b631be8b27246
MD5 5142b8f5a5c54a3891e994f7f4aef9c7
SHA1 ac84a9b4ea3a4e67acebc6eb6949fb79b9baac0d
SHA512 46fc42cd15a2632eb372768e00ba5871e67f0b37207db0f5500338b4f658a9d22d9a01cfb2cf9bf0453a60284b30df604d9d4130de875ed11eb239e1786291eb
SSDEEP 24576:LKfN6hWZPJIxaWScX7B27Mvr53f14iB7uRUfNfkJLD2aXGtXWgXm7lRERI:LKfUkI0c4Aci918F6aXGtBMERI
TLSH
T18B559C1225E1B976D0724E31AB7B97DC821DAF132B57C9DFE2D41C4B4A7C1827B312A2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

128158

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

TlsAlloc GetLastError EnterCriticalSection LeaveCriticalSection WaitForSingleObject CloseHandle InitializeCriticalSectionAndSpinCount DeleteCriticalSection CreateEventW WaitForMultipleObjects TerminateThread QueueUserAPC SetEvent SleepEx PostQueuedCompletionStatus CreateIoCompletionPort SetWaitableTimer GetQueuedCompletionStatus SetLastError VerSetConditionMask VerifyVersionInfoW VirtualAlloc TlsGetValue TlsSetValue TlsFree WriteConsoleW CreateFileW HeapSize ReadConsoleW SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetTimeZoneInformation HeapReAlloc SetFilePointerEx ReadFile GetConsoleMode GetConsoleCP FlushFileBuffers GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale WideCharToMultiByte DuplicateHandle WaitForSingleObjectEx Sleep GetCurrentProcess SwitchToThread GetCurrentThread GetCurrentThreadId GetExitCodeThread TryEnterCriticalSection EncodePointer DecodePointer RaiseException MultiByteToWideChar QueryPerformanceCounter GetSystemTimeAsFileTime GetTickCount GetModuleHandleW GetProcAddress CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo ResetEvent UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead FormatMessageA LocalFree CreateTimerQueue SignalObjectAndWait CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetThreadTimes FreeLibrary FreeLibraryAndExitThread GetModuleFileNameW GetModuleHandleA LoadLibraryExW GetVersionExW VirtualProtect VirtualFree ReleaseSemaphore InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx LoadLibraryW RtlUnwind ExitThread GetModuleHandleExW ExitProcess GetStdHandle WriteFile HeapFree HeapAlloc

user32

GetWindowModuleFileNameW

shell32

ord98 ord167 DragFinish ord90

ole32

OleInitialize

ws2_32

WSASend WSARecvFrom listen WSASendTo closesocket WSACleanup WSAStartup WSASetLastError WSASocketW WSAGetLastError setsockopt getaddrinfo freeaddrinfo bind htons ioctlsocket

mswsock

GetAcceptExSockaddrs AcceptEx

Name

.text

Size

326KB

Virtual Size

326KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vbbbh

Size

1024B

Virtual Size

965B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

89KB

Virtual Size

88KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

803KB

Virtual Size

808KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

116KB

Virtual Size

116KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

21KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.5142b8f5a5c54a3891e994f7f4aef9c7

kernel32

user32

shell32

ole32

ws2_32

mswsock

generic