jaffacakes118_not-a-virus[.]Downloader[.]Win32[.]DownloAdmin[.]amwi[.]dc243fa9f8bbf5379a5fc046b713ced9

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_not-a-virus.Downloader.Win32.DownloAdmin.amwi.dc243fa9f8bbf5379a5fc046b713ced9
Size 870KB
Sample261014-eby29afs2y
SHA256 8ce5982fa508cb9649b4d3265367f5f8dacfd0f1841cceefb9897d4679b03f00
MD5 dc243fa9f8bbf5379a5fc046b713ced9
SHA1 82a2d22834a390758f026a966fff0c9dfca08661
SHA512 74598fc3d8df284bbdf7b0c9bbb8cf321e268fbf58d8d79276e36735db64d0be93dd8c7a4a570577014142e5d6de94c05bd52c2101f7ad241e5d7ca22d4b760b
SSDEEP 12288:qaHrh6HC/wJkmGdRnSCcsJW+VGmLXbMpa6q9H5L3wcjRm/WDCc1buLbemNOk:qE6HCHjZcsorALZ1lAcF1Cc1buLbNsk
TLSH
T1C8152387F39589FBF8C88572B5B5D3258D18DB09833617C36F6598221B313D0E8B698E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Insecure Codesign Algorithm 1 IoCs

File was codesigned using an insecure algorithm.

resource
jaffacakes118_not-a-virus.Downloader.Win32.DownloAdmin.amwi.dc243fa9f8bbf5379a5fc046b713ced9

File Explorer

jaffacakes118_not-a-virus.Downloader.Win32.DownloAdmin.amwi.dc243fa9f8bbf5379a5fc046b713ced9

.exe 870KB

jaffacakes118_not-a-virus.Downloader.Win32.DownloAdmin.amwi.dc243fa9f8bbf5379a5fc046b713ced9

IMPHASH b06841a84b5387f1feb70432f9668cfd
SHA256 8ce5982fa508cb9649b4d3265367f5f8dacfd0f1841cceefb9897d4679b03f00
MD5 dc243fa9f8bbf5379a5fc046b713ced9
SHA1 82a2d22834a390758f026a966fff0c9dfca08661
SHA512 74598fc3d8df284bbdf7b0c9bbb8cf321e268fbf58d8d79276e36735db64d0be93dd8c7a4a570577014142e5d6de94c05bd52c2101f7ad241e5d7ca22d4b760b
SSDEEP 12288:qaHrh6HC/wJkmGdRnSCcsJW+VGmLXbMpa6q9H5L3wcjRm/WDCc1buLbemNOk:qE6HCHjZcsorALZ1lAcF1Cc1buLbNsk
TLSH
T1C8152387F39589FBF8C88572B5B5D3258D18DB09833617C36F6598221B313D0E8B698E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.

Digest

db:47:c6:45:d9:95:12:b1:d0:5f:82:24:76:69:a5:45:2a:db:8d:f6

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Razor Edge Media,O=Razor Edge Media,L=Oakland,ST=California,C=US

Chains

Nov 19, 2015

CN=Razor Edge Media,O=Razor Edge Media,L=Oakland,ST=California,C=US

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

CN=Razor Edge Media,O=Razor Edge Media,L=Oakland,ST=California,C=US

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

OU=Go Daddy Class 2 Certification Authority,O=The Go Daddy Group\, Inc.,C=US

Subject

CN=Razor Edge Media,O=Razor Edge Media,L=Oakland,ST=California,C=US

Serial Number

6f:2a:51:72:5d:c2:f5:11

Issuer

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 6, 2015 - Nov 6, 2016

Subject

CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Serial Number

1b:e7:15

Issuer

OU=Go Daddy Class 2 Certification Authority,O=The Go Daddy Group\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jan 1, 2014 - May 30, 2031

Subject

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Serial Number

Issuer

CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 3, 2011 - May 3, 2031

Subject

CN=Starfield Services Timestamp Authority - G1,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US

Serial Number

6c:2e:36:ad:af:9e:e4:14

Issuer

CN=Starfield Services Root Certificate Authority,OU=http://certificates.starfieldtech.com/repository/,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 16, 2015 - Mar 16, 2020

Minor OS version

Major OS version

Entry point

14358

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

debug.pdb

gdi32

DeleteObject EnumObjects SelectObject CreateBitmap CreateFontIndirectA CreateFontA CloseFigure Chord StrokePath Polygon

kernel32

GetVersion OutputDebugStringA lstrcpynA ExitProcess GetModuleFileNameA FreeLibrary DeleteFileA MapViewOfFile CloseHandle SetEnvironmentVariableA DuplicateHandle GetCurrentProcess GetCurrentProcessId CreateFileMappingA GetEnvironmentVariableA GetExitCodeProcess WaitForSingleObject TerminateProcess ResumeThread CreateProcessA GetCommandLineA GetLastError LoadLibraryA lstrcmpiA CreateFileA FlushFileBuffers WriteFile SetCurrentDirectoryA CreateDirectoryA GetFileAttributesA ExpandEnvironmentStringsA GetCurrentDirectoryA GetModuleHandleA ReadConsoleA WriteConsoleA GetStdHandle GetFullPathNameA SetErrorMode CreateTimerQueue BindIoCompletionCallback Sleep HeapSize FreeEnvironmentStringsA TlsFree GetProcessId TryEnterCriticalSection SuspendThread SetPriorityClass GetProcessHandleCount GetProcAddress MultiByteToWideChar GetVersionExA ReleaseMutex GetFileSize CreateMutexA GetCurrentThreadId GetTickCount QueryPerformanceCounter SetUnhandledExceptionFilter UnhandledExceptionFilter GetStartupInfoA InterlockedCompareExchange InterlockedExchange RtlUnwind FormatMessageA LocalFree GetSystemTimeAsFileTime

user32

ShowWindow EndPaint BeginPaint DrawTextA RegisterClassA PostMessageA TranslateMessage GetDC AttachThreadInput CreateWindowExA SendMessageW GetMessageA GetWindowLongA DispatchMessageA DrawTextW SendMessageA

comdlg32

GetSaveFileNameA CommDlgExtendedError GetOpenFileNameA

ole32

CoTaskMemFree CoCreateInstance CoInitializeEx OleInitialize

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetDiskFreeSpaceExA ord174 ShellExecuteExA SHFileOperationA

msvcrt

rand memset srand _pgmptr __argc __argv __CxxFrameHandler free memmove _ismbblead __getmainargs _cexit _exit realloc exit _acmdln _initterm _amsg_exit __setusermatherr __p__commode __p__fmode __set_app_type ?terminate@@YAXXZ _controlfp malloc _time64 atoi _snprintf _XcptFilter memcpy

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_not-a-virus.Downloader.Win32.DownloAdmin.amwi.dc243fa9f8bbf5379a5fc046b713ced9

gdi32

kernel32

user32

comdlg32

ole32

shell32

msvcrt

generic