jaffacakes118_not-a-virus[.]HEUR[.]AdWare[.]Win32[.]Generic[.]ab101e7032794b981077889f49f0609b

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.ab101e7032794b981077889f49f0609b
Size 659KB
Sample261014-e8645ags5r
SHA256 c468b2881757dae606405f2c3ad44adc72ce2f83d373395e091abfa34f53c4a5
MD5 ab101e7032794b981077889f49f0609b
SHA1 f2b4d3f1ac0a4f4b56ec91037177ee7bd8afc75e
SHA512 cc28998b6352bea8cca00a8e28d87b0b5718d84147358b192263554e20c382bfe886fafe341999db5570c193b1ce39695e708d81711237124ca8cb2d1be428fc
SSDEEP 12288:WETyLGOEZaOo59JELpYOFOf4bsSgXYSoAjDzC4i4O9tF9jv3FcNC:lMROaOovJcFOf4bsSgXYxAj3U3zv3u
TLSH
T163E41224B5C1C8B1E0361935C8A5E5F10A6EF8504E49BE9B37CC472E0E7C9D1B17AFA6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.ab101e7032794b981077889f49f0609b

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.ab101e7032794b981077889f49f0609b

.exe 659KB

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.ab101e7032794b981077889f49f0609b

IMPHASH 8394fa76cd215f217b1354b26a307caf
SHA256 c468b2881757dae606405f2c3ad44adc72ce2f83d373395e091abfa34f53c4a5
MD5 ab101e7032794b981077889f49f0609b
SHA1 f2b4d3f1ac0a4f4b56ec91037177ee7bd8afc75e
SHA512 cc28998b6352bea8cca00a8e28d87b0b5718d84147358b192263554e20c382bfe886fafe341999db5570c193b1ce39695e708d81711237124ca8cb2d1be428fc
SSDEEP 12288:WETyLGOEZaOo59JELpYOFOf4bsSgXYSoAjDzC4i4O9tF9jv3FcNC:lMROaOovJcFOf4bsSgXYxAj3U3zv3u
TLSH
T163E41224B5C1C8B1E0361935C8A5E5F10A6EF8504E49BE9B37CC472E0E7C9D1B17AFA6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6049

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetNamedPipeClientComputerNameW CreateFileW DecodePointer WriteConsoleW SetFilePointerEx GetConsoleMode GetConsoleCP FlushFileBuffers HeapReAlloc HeapSize GetMaximumProcessorGroupCount GetFinalPathNameByHandleW GetApplicationRecoveryCallback CreateMemoryResourceNotification AddSecureMemoryCacheCallback SetFileInformationByHandle GetProcessHeap GetStringTypeW GetFileType SetStdHandle LCMapStringW GetFileInformationByHandle GetModuleHandleW VirtualProtect UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwind GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameW MultiByteToWideChar WideCharToMultiByte ExitProcess GetModuleHandleExW GetACP HeapFree HeapAlloc CloseHandle FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW RaiseException

user32

CreateWindowExW ReleaseDC GetDC RegisterClassW LoadCursorW DefWindowProcW EndPaint BeginPaint SendMessageW

gdi32

ColorCorrectPalette CloseMetaFile CreateBrushIndirect CreateBitmapIndirect GetStockObject

shell32

ord192 ord168 ord167 ord98 ord92 ord90 SetCurrentProcessExplicitAppUserModelID ord170 ord709 SHLoadNonloadedIconOverlayIdentifiers Shell_GetCachedImageIndexW GetCurrentProcessExplicitAppUserModelID SHAssocEnumHandlersForProtocolByApplication

advapi32

QueryRecoveryAgentsOnEncryptedFile ConvertToAutoInheritPrivateObjectSecurity