jaffacakes118_not-a-virus[.]Downloader[.]Win32[.]DownloAdmin[.]amwi[.]25abf9c0350cac0b6887fc4f7609db7a

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_not-a-virus.Downloader.Win32.DownloAdmin.amwi.25abf9c0350cac0b6887fc4f7609db7a
Size 870KB
Sample261014-ebr9psfx8m
SHA256 6303564052cd11281e749dad8d7afbc8e2756c77f2a363a301bcd08f13a5c888
MD5 25abf9c0350cac0b6887fc4f7609db7a
SHA1 6af073f3dfb5e13d67f343908ee58787605cea11
SHA512 1e0f3dd20aa1e13cb794ec4dd0bfa81aa2ada3adfa1c35bb03effc76e10f80f23265534af26dbf8ed1dc4f11338456b12161e7e6a7d8dcd6310fa09c9f77b6a3
SSDEEP 12288:aaHrh6HC/wJkmGdRnSCcsJW+VGmLXbMpa6q9H5L3wcjRm/WDCc1buLbemNDR:aE6HCHjZcsorALZ1lAcF1Cc1buLbNZR
TLSH
T1DA152387F39589E7F8C88572F5B5D3258D18DB09833A07C36F6598621B313D0E8B698E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_not-a-virus.Downloader.Win32.DownloAdmin.amwi.25abf9c0350cac0b6887fc4f7609db7a

File Explorer

jaffacakes118_not-a-virus.Downloader.Win32.DownloAdmin.amwi.25abf9c0350cac0b6887fc4f7609db7a

.exe 870KB

jaffacakes118_not-a-virus.Downloader.Win32.DownloAdmin.amwi.25abf9c0350cac0b6887fc4f7609db7a

IMPHASH b06841a84b5387f1feb70432f9668cfd
SHA256 6303564052cd11281e749dad8d7afbc8e2756c77f2a363a301bcd08f13a5c888
MD5 25abf9c0350cac0b6887fc4f7609db7a
SHA1 6af073f3dfb5e13d67f343908ee58787605cea11
SHA512 1e0f3dd20aa1e13cb794ec4dd0bfa81aa2ada3adfa1c35bb03effc76e10f80f23265534af26dbf8ed1dc4f11338456b12161e7e6a7d8dcd6310fa09c9f77b6a3
SSDEEP 12288:aaHrh6HC/wJkmGdRnSCcsJW+VGmLXbMpa6q9H5L3wcjRm/WDCc1buLbemNDR:aE6HCHjZcsorALZ1lAcF1Cc1buLbNZR
TLSH
T1DA152387F39589E7F8C88572F5B5D3258D18DB09833A07C36F6598621B313D0E8B698E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

14358

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

debug.pdb

gdi32

DeleteObject EnumObjects SelectObject CreateBitmap CreateFontIndirectA CreateFontA CloseFigure Chord StrokePath Polygon

kernel32

GetVersion OutputDebugStringA lstrcpynA ExitProcess GetModuleFileNameA FreeLibrary DeleteFileA MapViewOfFile CloseHandle SetEnvironmentVariableA DuplicateHandle GetCurrentProcess GetCurrentProcessId CreateFileMappingA GetEnvironmentVariableA GetExitCodeProcess WaitForSingleObject TerminateProcess ResumeThread CreateProcessA GetCommandLineA GetLastError LoadLibraryA lstrcmpiA CreateFileA FlushFileBuffers WriteFile SetCurrentDirectoryA CreateDirectoryA GetFileAttributesA ExpandEnvironmentStringsA GetCurrentDirectoryA GetModuleHandleA ReadConsoleA WriteConsoleA GetStdHandle GetFullPathNameA SetErrorMode CreateTimerQueue BindIoCompletionCallback Sleep HeapSize FreeEnvironmentStringsA TlsFree GetProcessId TryEnterCriticalSection SuspendThread SetPriorityClass GetProcessHandleCount GetProcAddress MultiByteToWideChar GetVersionExA ReleaseMutex GetFileSize CreateMutexA GetCurrentThreadId GetTickCount QueryPerformanceCounter SetUnhandledExceptionFilter UnhandledExceptionFilter GetStartupInfoA InterlockedCompareExchange InterlockedExchange RtlUnwind FormatMessageA LocalFree GetSystemTimeAsFileTime

user32

ShowWindow EndPaint BeginPaint DrawTextA RegisterClassA PostMessageA TranslateMessage GetDC AttachThreadInput CreateWindowExA SendMessageW GetMessageA GetWindowLongA DispatchMessageA DrawTextW SendMessageA

comdlg32

GetSaveFileNameA CommDlgExtendedError GetOpenFileNameA

ole32

CoTaskMemFree CoCreateInstance CoInitializeEx OleInitialize

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetDiskFreeSpaceExA ord174 ShellExecuteExA SHFileOperationA

msvcrt

rand memset srand _pgmptr __argc __argv __CxxFrameHandler free memmove _ismbblead __getmainargs _cexit _exit realloc exit _acmdln _initterm _amsg_exit __setusermatherr __p__commode __p__fmode __set_app_type ?terminate@@YAXXZ _controlfp malloc _time64 atoi _snprintf _XcptFilter memcpy