jaffacakes118_not-a-virus[.]HEUR[.]AdWare[.]Win32[.]Generic[.]b8e280a822b312a29b9f00eaf771155d

General

Target
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.b8e280a822b312a29b9f00eaf771155d
Size 2.2MB
Sample261014-e9qtjaws4p
SHA256 11c82572d287e04747c0543442778bcf67a6f03d863cc70bcd6c7a60a3ab2a09
MD5 b8e280a822b312a29b9f00eaf771155d
SHA1 a0f8a3e6a7ead658b8ecde187cc5346c34329529
SHA512 e85d05db9406d4a89c352f526579f74ea2c67c40174c52beb048b5220ba0f3332cf710b37e9783772db7b3dc8659f130bd78cf5fc87efc6dd412a6f67abfa114
SSDEEP 24576:An8/cHl/4xkUE04gHS1ozFqGXF7/YKYMEbLbTbgUjLn:An8SJ4XFHS/I7gqEbIyn
TLSH
T1A1B5E010B851D135F9B305B58EFD8A7F512CAD001B1864EBB3CC69AE4FB69E2373251A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.b8e280a822b312a29b9f00eaf771155d

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.b8e280a822b312a29b9f00eaf771155d

.exe 2.2MB

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.b8e280a822b312a29b9f00eaf771155d

IMPHASH 8591f7427e7ef79898c311da16b6b7af
SHA256 11c82572d287e04747c0543442778bcf67a6f03d863cc70bcd6c7a60a3ab2a09
MD5 b8e280a822b312a29b9f00eaf771155d
SHA1 a0f8a3e6a7ead658b8ecde187cc5346c34329529
SHA512 e85d05db9406d4a89c352f526579f74ea2c67c40174c52beb048b5220ba0f3332cf710b37e9783772db7b3dc8659f130bd78cf5fc87efc6dd412a6f67abfa114
SSDEEP 24576:An8/cHl/4xkUE04gHS1ozFqGXF7/YKYMEbLbTbgUjLn:An8SJ4XFHS/I7gqEbIyn
TLSH
T1A1B5E010B851D135F9B305B58EFD8A7F512CAD001B1864EBB3CC69AE4FB69E2373251A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

204215

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetMaximumProcessorGroupCount GetNamedPipeClientComputerNameW HeapSize CreateFileW WriteConsoleW ReadConsoleW SetStdHandle GetFinalPathNameByHandleW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetApplicationRecoveryCallback CreateMemoryResourceNotification AddSecureMemoryCacheCallback SetFileInformationByHandle GetFileInformationByHandle GetModuleHandleW VirtualProtect GetTickCount IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetProcessHeap EnumSystemLocalesW GetUserDefaultLCID IsValidLocale SetFilePointerEx WideCharToMultiByte EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar SetLastError InitializeCriticalSectionAndSpinCount CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetProcAddress LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo CloseHandle SetEvent ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead RaiseException RtlUnwind GetLastError FreeLibrary LoadLibraryExW HeapAlloc HeapReAlloc HeapFree ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile GetACP GetFileType FlushFileBuffers GetConsoleCP GetConsoleMode ReadFile SetEndOfFile

user32

CreateWindowExW ReleaseDC AnimateWindow SetForegroundWindow AdjustWindowRectEx AdjustWindowRect AddClipboardFormatListener RegisterClassW LoadCursorW DefWindowProcW EndPaint BeginPaint SendMessageW GetDC

gdi32

CreatePalette CreateMetaFileW CreateHatchBrush CreateHalftonePalette CreateFontW ColorCorrectPalette GetStockObject CreateSolidBrush

shell32

SHGetItemFromDataObject SHGetInstanceExplorer SHGetFolderLocation SHGetFileInfoW SHFileOperationW DuplicateIcon DragQueryPoint DragQueryFileW DragFinish DragAcceptFiles DoEnvironmentSubstW ord256 ord192 ord168

Name

.text

Size

326KB

Virtual Size

325KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

1024B

Virtual Size

652B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

356KB

Virtual Size

355KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Generic.b8e280a822b312a29b9f00eaf771155d

kernel32

user32

gdi32

shell32

generic