jaffacakes118_not-a-virus[.]HEUR[.]AdWare[.]Win32[.]Generic[.]65901ff8690c4a34697cf2e0e2ae342c

General

Target
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.65901ff8690c4a34697cf2e0e2ae342c
Size 2.5MB
Sample261014-e63zpav19p
SHA256 142d6c3767cd49752e2128a32ee2e9d5e46d826beff110cbd424910e3ec7bd5d
MD5 65901ff8690c4a34697cf2e0e2ae342c
SHA1 04e90fbb9f2d2fbff4ad9bf89ba8666d51b65872
SHA512 526c3c8b287f6b6f38d895697999afa1e416d8e9dd5ce1caf4c930e0cc74cef5c3660853b47930715cd585437d0ec888e8cdd6d2020e2205934039783f3bb5be
SSDEEP 12288:C4u7bQ8cx55QXtYZh4OwSz4Xmi1aztwZXAerY3yh:C4u7bQ8eIkhyV1YwxAM2y
TLSH
T1EEC51283B4C0C971D8B69F34B471CBA297BA35115E204E6757402AAE1F780D0AE3DFA7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.65901ff8690c4a34697cf2e0e2ae342c

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.65901ff8690c4a34697cf2e0e2ae342c

.exe 2.5MB

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.65901ff8690c4a34697cf2e0e2ae342c

IMPHASH b4e648bbbadc6230d6ac381bba226a88
SHA256 142d6c3767cd49752e2128a32ee2e9d5e46d826beff110cbd424910e3ec7bd5d
MD5 65901ff8690c4a34697cf2e0e2ae342c
SHA1 04e90fbb9f2d2fbff4ad9bf89ba8666d51b65872
SHA512 526c3c8b287f6b6f38d895697999afa1e416d8e9dd5ce1caf4c930e0cc74cef5c3660853b47930715cd585437d0ec888e8cdd6d2020e2205934039783f3bb5be
SSDEEP 12288:C4u7bQ8cx55QXtYZh4OwSz4Xmi1aztwZXAerY3yh:C4u7bQ8eIkhyV1YwxAM2y
TLSH
T1EEC51283B4C0C971D8B69F34B471CBA297BA35115E204E6757402AAE1F780D0AE3DFA7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

5264

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetConsoleCP GetConsoleMode SetFilePointerEx WriteConsoleW DecodePointer CreateFileW GetModuleHandleW FlushFileBuffers HeapReAlloc HeapSize GetProcessHeap GetStringTypeW GetFileType SetStdHandle LCMapStringW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwind GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameW MultiByteToWideChar WideCharToMultiByte ExitProcess GetModuleHandleExW GetACP HeapFree HeapAlloc CloseHandle FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW RaiseException

user32

AdjustWindowRect CalculatePopupWindowPosition GetMenuCheckMarkDimensions AddClipboardFormatListener DisableProcessWindowsGhosting GetWindowModuleFileNameW

gdi32

CloseMetaFile ColorCorrectPalette CreateHalftonePalette SetDIBitsToDevice CreateSolidBrush CreatePalette CreateHatchBrush CreateBitmapIndirect

shell32

DoEnvironmentSubstW DragAcceptFiles DragFinish DragQueryFileW ord256 ord92 ord90 ord168 ord192 SHAssocEnumHandlersForProtocolByApplication GetCurrentProcessExplicitAppUserModelID SetCurrentProcessExplicitAppUserModelID

Name

.text

Size

41KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

172B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.65901ff8690c4a34697cf2e0e2ae342c

kernel32

user32

gdi32

shell32

generic