jaffacakes118_not-a-virus[.]Downloader[.]Win32[.]DownloaderGuide[.]pwj[.]ec7971cf096bbc1f63f93c0193550ca9

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_not-a-virus.Downloader.Win32.DownloaderGuide.pwj.ec7971cf096bbc1f63f93c0193550ca9
Size 525KB
Sample261014-ed5mtafs6w
SHA256 dc25c331e637bf8cccb266fe31e1d87725b5eb3f950c291ac9bc54cf7053c040
MD5 ec7971cf096bbc1f63f93c0193550ca9
SHA1 a92d5a08afa1ba2e4e7df6bc68ff291539b7fc22
SHA512 6d20d4e0c1fab4ea358bc9b4fd392c8474ca2aeec87b7e0d06f8aefbe0e408f78fc2cb11b373d52dc00829d654b57aa65ff2d452574e1379c9801e3b09b1eafa
SSDEEP 6144:ZpyDjMLE6JNxe/2+sAMRZmIHAcnwZJNoE6aCJwSZtFehEfkdhNB92q78VQYY1hHX:ZM4vuOXAn6RwZJN36bFZaR3Vm
TLSH
T187B47E26A281F176E47208F25A7BE6B215747F326414C907A7783F2E6FB02E0ED15367
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
jaffacakes118_not-a-virus.Downloader.Win32.DownloaderGuide.pwj.ec7971cf096bbc1f63f93c0193550ca9

File Explorer

jaffacakes118_not-a-virus.Downloader.Win32.DownloaderGuide.pwj.ec7971cf096bbc1f63f93c0193550ca9

.exe 525KB

jaffacakes118_not-a-virus.Downloader.Win32.DownloaderGuide.pwj.ec7971cf096bbc1f63f93c0193550ca9

IMPHASH 2e4917721025ea1a5fc04c6b0f17dd66
SHA256 dc25c331e637bf8cccb266fe31e1d87725b5eb3f950c291ac9bc54cf7053c040
MD5 ec7971cf096bbc1f63f93c0193550ca9
SHA1 a92d5a08afa1ba2e4e7df6bc68ff291539b7fc22
SHA512 6d20d4e0c1fab4ea358bc9b4fd392c8474ca2aeec87b7e0d06f8aefbe0e408f78fc2cb11b373d52dc00829d654b57aa65ff2d452574e1379c9801e3b09b1eafa
SSDEEP 6144:ZpyDjMLE6JNxe/2+sAMRZmIHAcnwZJNoE6aCJwSZtFehEfkdhNB92q78VQYY1hHX:ZM4vuOXAn6RwZJN36bFZaR3Vm
TLSH
T187B47E26A281F176E47208F25A7BE6B215747F326414C907A7783F2E6FB02E0ED15367
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

af:a9:07:e3:77:4a:6c:36:4e:41:c5:72:77:03:22:44:e7:54:f8:5b

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Freemium GmbH,O=Freemium GmbH,POSTALCODE=10119,STREET=Schwedter Straße 9a,L=Berlin,ST=Berlin,C=DE

Chains

Oct 7, 2026

CN=Freemium GmbH,O=Freemium GmbH,POSTALCODE=10119,STREET=Schwedter Straße 9a,L=Berlin,ST=Berlin,C=DE

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

CN=Freemium GmbH,O=Freemium GmbH,POSTALCODE=10119,STREET=Schwedter Straße 9a,L=Berlin,ST=Berlin,C=DE

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

CN=Freemium GmbH,O=Freemium GmbH,POSTALCODE=10119,STREET=Schwedter Straße 9a,L=Berlin,ST=Berlin,C=DE

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Serial Number

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 30, 2000 - May 30, 2020

Subject

CN=Freemium GmbH,O=Freemium GmbH,POSTALCODE=10119,STREET=Schwedter Straße 9a,L=Berlin,ST=Berlin,C=DE

Serial Number

bc:ed:ce:12:9e:9a:a2:36:bb:f4:bc:05:9a:58:ba:55

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 6, 2016 - Apr 12, 2017

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 30, 2000 - May 30, 2020

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 9, 2013 - May 8, 2028

Minor OS version

Major OS version

Entry point

80956

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

DeleteCriticalSection InitializeCriticalSectionAndSpinCount LocalAlloc LoadLibraryA CreateEventW CreateMutexW DeleteFileW SetFilePointerEx SetFileTime GetVersionExW GetFileAttributesExW ExpandEnvironmentStringsW GetCommandLineW GetTempFileNameW GetCurrentDirectoryW GetSystemTimeAsFileTime SystemTimeToFileTime VirtualQuery GetExitCodeProcess WideCharToMultiByte GlobalAlloc GetProcessHeap HeapFree GetFileInformationByHandle FindClose GetFullPathNameW FindFirstFileW FindNextFileW DebugBreak OutputDebugStringW lstrlenA LoadLibraryW MulDiv lstrcmpW GlobalUnlock GlobalLock FlushFileBuffers CloseHandle CreateFileW ReadFile WriteConsoleW SetStdHandle InterlockedIncrement LCMapStringW GetConsoleMode GetConsoleCP SetFilePointer RtlUnwind GetCurrentProcessId GetTickCount QueryPerformanceCounter GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetStringTypeW IsValidCodePage GetOEMCP GetACP GetCPInfo TlsFree TlsSetValue TlsGetValue TlsAlloc GetStdHandle WriteFile HeapReAlloc HeapCreate ExitProcess HeapSize Sleep IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess GetStartupInfoW HeapSetInformation DecodePointer EncodePointer InterlockedPopEntrySList VirtualAlloc VirtualFree lstrlenW InterlockedDecrement GetModuleFileNameW LoadLibraryExW FindResourceW LoadResource SizeofResource MultiByteToWideChar lstrcmpiW FreeLibrary SetLastError GetLastError RaiseException GetCurrentThreadId FlushInstructionCache GetCurrentProcess GetModuleHandleW GetProcAddress LeaveCriticalSection EnterCriticalSection IsProcessorFeaturePresent HeapAlloc InterlockedPushEntrySList InterlockedCompareExchange

user32

GetClassInfoExW DestroyWindow SetTimer DefWindowProcW CreateWindowExW RegisterClassExW LoadCursorW GetWindowLongW KillTimer SetWindowLongW CreateAcceleratorTableW RegisterWindowMessageW BeginPaint FillRect EndPaint IsChild SetFocus GetDlgItem GetClassNameW GetSysColor RedrawWindow UnregisterClassA InvalidateRect GetDesktopWindow GetFocus UpdateWindow SetWindowTextW GetWindowTextW GetWindowTextLengthW SendMessageW ClientToScreen ReleaseDC GetDC PostMessageW ShowWindow IsWindowVisible GetWindow MonitorFromWindow GetMonitorInfoW GetParent GetClientRect MapWindowPoints SetWindowPos MoveWindow GetWindowRect IsWindow UpdateLayeredWindow PeekMessageW GetMessageW TranslateMessage DispatchMessageW CharNextW CallWindowProcW

gdi32

CreateSolidBrush GetStockObject GetDeviceCaps GetObjectW SelectObject CreateCompatibleDC DeleteDC DeleteObject

comdlg32

GetSaveFileNameW

advapi32

RegQueryInfoKeyW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegSetValueExW RegQueryValueExW RegCreateKeyExW RegOpenKeyExW RegCloseKey

shell32

Shell_NotifyIconW SHGetFolderPathW

ole32

CoCreateInstance OleInitialize CreateStreamOnHGlobal OleLockRunning OleUninitialize CoMarshalInterThreadInterfaceInStream CoUninitialize CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree

oleaut32

SysStringLen VarUI4FromStr VariantCopy OleCreateFontIndirect DispCallFunc VarBstrCat SysStringByteLen SysAllocStringByteLen LoadTypeLi SysFreeString VariantInit VariantClear VariantChangeType SysAllocString LoadRegTypeLi

shlwapi

PathFileExistsW

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_not-a-virus.Downloader.Win32.DownloaderGuide.pwj.ec7971cf096bbc1f63f93c0193550ca9

PE Signature issue

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

generic