jaffacakes118_not-a-virus[.]Downloader[.]Win32[.]Hafen[.]a[.]b3cf78cdafd748fd1e6e111bd9292ce8

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_not-a-virus.Downloader.Win32.Hafen.a.b3cf78cdafd748fd1e6e111bd9292ce8
Size 714KB
Sample261014-eebfcsx1ct
SHA256 9a30a11c57621b967cc40a6e65fc0f41657143327133e112b49d883a639ea7bd
MD5 b3cf78cdafd748fd1e6e111bd9292ce8
SHA1 1af68d1f6ffe2ef86c7c804822645aede5ab0749
SHA512 ac7606ab83be8200fd37df20eb067cd22816fa8009f435aab80a2df1d1947155c138385d8f3c3814431fab2f1d58382586619411d5e86eadca8134dff93f213f
SSDEEP 12288:R/qod+YDluRjopCvirUDePfUWrbsaESUQb/zolwPoc1HvAQ7gAEXG:R/Ld+YDiocvirUD8fZrbdqQ4kocpq
TLSH
T145F423126BB05447D299AEB29D05DAB76274FC0063E9260137D87FBFBD3638591280BF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

installer

Malware Config

Signatures

Insecure Codesign Algorithm 1 IoCs

File was codesigned using an insecure algorithm.

resource
jaffacakes118_not-a-virus.Downloader.Win32.Hafen.a.b3cf78cdafd748fd1e6e111bd9292ce8

NSIS installer 1 IoCs

installer

resource	yara_rule
sample	nsis_installer_2

File Explorer

jaffacakes118_not-a-virus.Downloader.Win32.Hafen.a.b3cf78cdafd748fd1e6e111bd9292ce8

.exe 714KB

jaffacakes118_not-a-virus.Downloader.Win32.Hafen.a.b3cf78cdafd748fd1e6e111bd9292ce8

IMPHASH 470282e4fe2ebbf8acb122584604aac8
SHA256 9a30a11c57621b967cc40a6e65fc0f41657143327133e112b49d883a639ea7bd
MD5 b3cf78cdafd748fd1e6e111bd9292ce8
SHA1 1af68d1f6ffe2ef86c7c804822645aede5ab0749
SHA512 ac7606ab83be8200fd37df20eb067cd22816fa8009f435aab80a2df1d1947155c138385d8f3c3814431fab2f1d58382586619411d5e86eadca8134dff93f213f
SSDEEP 12288:R/qod+YDluRjopCvirUDePfUWrbsaESUQb/zolwPoc1HvAQ7gAEXG:R/Ld+YDiocvirUD8fZrbdqQ4kocpq
TLSH
T145F423126BB05447D299AEB29D05DAB76274FC0063E9260137D87FBFBD3638591280BF
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.
NSIS installer

installer

Digest

73:42:ca:a6:ad:24:be:4d:bd:a5:d6:51:45:b2:79:14:9e:a0:b5:e9

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=上海旭岑投资合伙企业（有限合伙）,OU=IT,O=上海旭岑投资合伙企业（有限合伙）,L=Shanghai,ST=Shanghai,C=CN

Chains

Nov 15, 2017

CN=上海旭岑投资合伙企业（有限合伙）,OU=IT,O=上海旭岑投资合伙企业（有限合伙）,L=Shanghai,ST=Shanghai,C=CN

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Minor OS version

Major OS version

Entry point

13085

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

user32

RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA SetWindowPos IsWindowEnabled SetClassLongA GetSystemMenu EnableMenuItem EndDialog GetSystemMetrics CreatePopupMenu AppendMenuA GetWindowRect SetDlgItemTextA OpenClipboard EmptyClipboard SetClipboardData CloseClipboard LoadBitmapA IsWindowVisible CallWindowProcA GetMessagePos ScreenToClient CheckDlgButton LoadCursorA SetCursor GetWindowLongA GetSysColor CharNextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA TrackPopupMenu ExitWindowsEx DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow ShowWindow wsprintfA SendMessageTimeoutA FindWindowExA IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint

kernel32

RemoveDirectoryA GetSystemDirectoryA lstrcatA GetTempFileNameA CreateFileA CreateProcessA CreateDirectoryA GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceA lstrcpynA SetErrorMode GetVersion lstrlenA GetCommandLineA GetTempPathA GetWindowsDirectoryA ExitProcess CopyFileA GetCurrentProcess GetModuleFileNameA GetFileSize GetTickCount Sleep SetFileAttributesA GetFileAttributesA SetCurrentDirectoryA MoveFileA GetFullPathNameA GetShortPathNameA SearchPathA CompareFileTime SetFileTime CloseHandle lstrcmpiA MulDiv DeleteFileA FindFirstFileA FindNextFileA FindClose SetFilePointer ReadFile WriteFile GetPrivateProfileStringA WritePrivateProfileStringA MultiByteToWideChar FreeLibrary GetProcAddress LoadLibraryExA GetModuleHandleA GlobalFree GetExitCodeProcess WaitForSingleObject GlobalAlloc ExpandEnvironmentStringsA lstrcmpA

shell32

SHGetSpecialFolderLocation SHBrowseForFolderA SHGetPathFromIDListA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegDeleteKeyA RegCloseKey RegEnumKeyA RegOpenKeyExA RegEnumValueA RegQueryValueExA RegSetValueExA RegCreateKeyExA RegDeleteValueA SetFileSecurityA

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

gdi32

SelectObject SetTextColor SetBkMode CreateFontIndirectA CreateBrushIndirect DeleteObject GetDeviceCaps SetBkColor

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

ntdll

_allshl _aulldiv _allmul _alldiv _allrem _allshr