jaffacakes118_not-a-virus[.]HEUR[.]AdWare[.]Win32[.]Generic[.]97d3baff69c9fbffa680fa94428c5cfe

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.97d3baff69c9fbffa680fa94428c5cfe
Size 548KB
Sample261014-e8gt8sfw81
SHA256 c7e95d86d3d13fd7f2e2e76f7472c882fc0019e93f135e69b6e4a57a436c7b53
MD5 97d3baff69c9fbffa680fa94428c5cfe
SHA1 eb3bc5f2f60b64b10c29ac4dd13be62f8895e765
SHA512 6b6b088a2284fa8d54fea57f051ae2e28ca213b3807871bf927d4d43daeeffba82ec2b26956bde6d9235dc76c4293a910065d9b96d2890d28cfbf8b1249560e5
SSDEEP 12288:kuR7PJVLEZuzja6FzJoIXrLwUj5EohGedKPtiq:9JJOZuzTzGALbjRhGeEtt
TLSH
T101C48D2631E6EA71D09204F11F9BA3326874A7737029D62363E48FAF5F7C1E0991572B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.97d3baff69c9fbffa680fa94428c5cfe

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.97d3baff69c9fbffa680fa94428c5cfe

.exe 548KB

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.97d3baff69c9fbffa680fa94428c5cfe

IMPHASH 99355687ecd8da3841aff179d411c68c
SHA256 c7e95d86d3d13fd7f2e2e76f7472c882fc0019e93f135e69b6e4a57a436c7b53
MD5 97d3baff69c9fbffa680fa94428c5cfe
SHA1 eb3bc5f2f60b64b10c29ac4dd13be62f8895e765
SHA512 6b6b088a2284fa8d54fea57f051ae2e28ca213b3807871bf927d4d43daeeffba82ec2b26956bde6d9235dc76c4293a910065d9b96d2890d28cfbf8b1249560e5
SSDEEP 12288:kuR7PJVLEZuzja6FzJoIXrLwUj5EohGedKPtiq:9JJOZuzTzGALbjRhGeEtt
TLSH
T101C48D2631E6EA71D09204F11F9BA3326874A7737029D62363E48FAF5F7C1E0991572B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

99:a8:e5:9e:b0:da:4f:e1:af:00:69:ed:38:6a:17:ce:8f:35:32:b7

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Freemium GmbH,O=Freemium GmbH,POSTALCODE=10119,STREET=Schwedter Straße 9A,L=Berlin,ST=Berlin,C=DE

Chains

Oct 7, 2026

CN=Freemium GmbH,O=Freemium GmbH,POSTALCODE=10119,STREET=Schwedter Straße 9A,L=Berlin,ST=Berlin,C=DE

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

CN=Freemium GmbH,O=Freemium GmbH,POSTALCODE=10119,STREET=Schwedter Straße 9A,L=Berlin,ST=Berlin,C=DE

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

CN=Freemium GmbH,O=Freemium GmbH,POSTALCODE=10119,STREET=Schwedter Straße 9A,L=Berlin,ST=Berlin,C=DE

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Serial Number

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 30, 2000 - May 30, 2020

Subject

CN=Freemium GmbH,O=Freemium GmbH,POSTALCODE=10119,STREET=Schwedter Straße 9A,L=Berlin,ST=Berlin,C=DE

Serial Number

48:ec:05:2d:ad:94:98:23:d9:66:e3:f7:7e:c8:1e:59

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 23, 2018 - May 23, 2019

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 30, 2000 - May 30, 2020

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 9, 2013 - May 8, 2028

Minor OS version

Major OS version

Entry point

81532

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

DeleteCriticalSection InitializeCriticalSectionAndSpinCount LocalAlloc LoadLibraryA WaitForMultipleObjects WaitForSingleObject DeleteFileW CreateFileW SetFilePointerEx SetFileTime ResetEvent GetFileSize ReadFile MoveFileExW UnmapViewOfFile GetExitCodeProcess WideCharToMultiByte HeapAlloc lstrcpynW FindClose GetFullPathNameW FindFirstFileW FindNextFileW DebugBreak OutputDebugStringW lstrlenA LoadLibraryW MulDiv lstrcmpW GlobalUnlock GlobalLock GlobalAlloc FlushFileBuffers CloseHandle WriteConsoleW SetStdHandle LCMapStringW GetConsoleMode InterlockedIncrement SetFilePointer RtlUnwind GetCurrentProcessId GetTickCount QueryPerformanceCounter GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetStringTypeW IsValidCodePage GetOEMCP GetACP GetCPInfo TlsFree TlsSetValue TlsGetValue TlsAlloc GetStdHandle WriteFile HeapReAlloc HeapCreate ExitProcess HeapSize Sleep IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess GetStartupInfoW HeapSetInformation GetCommandLineW GetSystemTimeAsFileTime DecodePointer EncodePointer InterlockedPopEntrySList VirtualAlloc VirtualFree IsProcessorFeaturePresent InterlockedDecrement GetModuleFileNameW lstrlenW LoadLibraryExW FindResourceW LoadResource SizeofResource MultiByteToWideChar lstrcmpiW FreeLibrary SetLastError GetLastError RaiseException GetCurrentThreadId FlushInstructionCache GetCurrentProcess GetModuleHandleW GetProcAddress LeaveCriticalSection EnterCriticalSection GetConsoleCP GetProcessHeap HeapFree InterlockedPushEntrySList InterlockedCompareExchange

user32

RegisterClassExW GetClassInfoExW CreateWindowExW LoadCursorW DestroyWindow KillTimer SetTimer DefWindowProcW GetWindowLongW SetWindowLongW CreateAcceleratorTableW RegisterWindowMessageW BeginPaint FillRect EndPaint IsChild SetFocus GetDlgItem GetClassNameW GetSysColor RedrawWindow UnregisterClassA InvalidateRect GetDesktopWindow GetFocus UpdateWindow SetWindowTextW GetWindowTextW GetWindowTextLengthW SendMessageW ClientToScreen ReleaseDC GetDC PostMessageW ShowWindow IsWindowVisible GetWindow MonitorFromWindow GetMonitorInfoW GetParent GetClientRect MapWindowPoints SetWindowPos MoveWindow GetWindowRect IsWindow LoadImageW PeekMessageW GetMessageW TranslateMessage DispatchMessageW CharNextW CallWindowProcW

gdi32

CreateSolidBrush GetStockObject GetDeviceCaps GetObjectW SelectObject DeleteDC DeleteObject CreateCompatibleDC

advapi32

RegEnumValueW RegQueryInfoKeyW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegSetValueExW RegQueryValueExW RegCreateKeyExW RegOpenKeyExW RegCloseKey

shell32

DoEnvironmentSubstW

ole32

CoCreateInstance CoTaskMemFree OleInitialize CreateStreamOnHGlobal OleLockRunning OleUninitialize CoMarshalInterThreadInterfaceInStream CoInitialize CoTaskMemAlloc CoTaskMemRealloc

oleaut32

LoadRegTypeLi SysStringLen OleCreateFontIndirect DispCallFunc VarBstrCat SysStringByteLen SysAllocStringByteLen LoadTypeLi SysFreeString VariantInit VariantClear VariantChangeType SysAllocString VariantCopy VarUI4FromStr

shlwapi

PathRemoveFileSpecW PathFileExistsW

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.97d3baff69c9fbffa680fa94428c5cfe

PE Signature issue

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

generic