jaffacakes118_not-a-virus[.]Downloader[.]Win32[.]IdleLayer[.]a[.]5ccbf8aaccd755c851fe55e02c5d2339

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_not-a-virus.Downloader.Win32.IdleLayer.a.5ccbf8aaccd755c851fe55e02c5d2339
Size 100KB
Sample261014-eergksfs7t
SHA256 6f664c223f0383528fbf9ae08e6c899a6443aa68439bed0d28a5d0b4f4ff41b1
MD5 5ccbf8aaccd755c851fe55e02c5d2339
SHA1 cae03b8042ba7c45a869553d3e4b62b04e89f92b
SHA512 a503c1809b317c81d729b3442fb72db36f73ad1489683c37e4423617ed606852ea93d277f53ef9c37e145e36c2e61948acee084e1ce48e0b063379ad33799d08
SSDEEP 1536:5hepkeZqqidPe2nfGqS3UjaejycQY3oAiFxO8xM44vNfXBv27iLyE3d:5hepkoqqyDU3GplYbFxOUOBYiyE3d
TLSH
T176A33C43F9C241E2E61D1230086D7736D667D57E4F258BA39368DE2E59270829D3E38F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_not-a-virus.Downloader.Win32.IdleLayer.a.5ccbf8aaccd755c851fe55e02c5d2339

File Explorer

jaffacakes118_not-a-virus.Downloader.Win32.IdleLayer.a.5ccbf8aaccd755c851fe55e02c5d2339

.exe 100KB

jaffacakes118_not-a-virus.Downloader.Win32.IdleLayer.a.5ccbf8aaccd755c851fe55e02c5d2339

IMPHASH cb99743a4eb99df4d3f4555b227854e2
SHA256 6f664c223f0383528fbf9ae08e6c899a6443aa68439bed0d28a5d0b4f4ff41b1
MD5 5ccbf8aaccd755c851fe55e02c5d2339
SHA1 cae03b8042ba7c45a869553d3e4b62b04e89f92b
SHA512 a503c1809b317c81d729b3442fb72db36f73ad1489683c37e4423617ed606852ea93d277f53ef9c37e145e36c2e61948acee084e1ce48e0b063379ad33799d08
SSDEEP 1536:5hepkeZqqidPe2nfGqS3UjaejycQY3oAiFxO8xM44vNfXBv27iLyE3d:5hepkoqqyDU3GplYbFxOUOBYiyE3d
TLSH
T176A33C43F9C241E2E61D1230086D7736D667D57E4F258BA39368DE2E59270829D3E38F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

57014

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

wininet

InternetSetFilePointer InternetCloseHandle InternetReadFile InternetOpenUrlA InternetOpenA

shlwapi

PathFileExistsA

mfc42

ord5714 ord4622 ord3738 ord561 ord815 ord3626 ord3663 ord641 ord2841 ord609 ord765 ord2414 ord2514 ord860 ord2621 ord1134 ord2107 ord5450 ord5440 ord6383 ord6394 ord858 ord5265 ord4853 ord4998 ord6052 ord1775 ord5280 ord4425 ord3597 ord4407 ord3698 ord2575 ord4396 ord3402 ord3574 ord3619 ord3573 ord1146 ord1168 ord324 ord2302 ord4234 ord4376 ord1200 ord5896 ord6199 ord1641 ord2642 ord5953 ord6215 ord6880 ord3092 ord4710 ord665 ord1105 ord6385 ord924 ord1979 ord823 ord5442 ord5773 ord3318 ord5186 ord354 ord537 ord5890 ord922 ord535 ord2937 ord755 ord2379 ord470 ord4224 ord941 ord5710 ord6453 ord3097 ord2645 ord2818 ord4476 ord940 ord2764 ord384 ord686 ord772 ord3701 ord500 ord1862 ord4220 ord2584 ord3654 ord2438 ord6142 ord4083 ord2863 ord5606 ord3571 ord3693 ord5289 ord2763 ord4277 ord5683 ord2567 ord5788 ord2614 ord2971 ord5759 ord6192 ord5756 ord6186 ord4330 ord6189 ord6021 ord6172 ord5873 ord5789 ord5794 ord5678 ord5736 ord5579 ord5571 ord6061 ord5864 ord3596 ord640 ord6194 ord1640 ord323 ord2405 ord5785 ord2864 ord1175 ord2096 ord2408 ord5860 ord539 ord807 ord2920 ord2012 ord2120 ord554 ord1576 ord1644 ord5572 ord2919 ord939 ord5787 ord4133 ord4297 ord1621 ord4202 ord5856 ord536 ord2452 ord2753 ord1195 ord472 ord809 ord556 ord4284 ord5053 ord4774 ord5981 ord6270 ord3874 ord613 ord289 ord2122 ord283 ord3721 ord795 ord6157 ord1601 ord5307 ord4698 ord4079 ord2725 ord5302 ord5300 ord3346 ord2396 ord5199 ord1089 ord3922 ord5731 ord2512 ord2554 ord4486 ord6375 ord4274 ord4673 ord4758 ord2859 ord4123 ord4060 ord5875 ord540 ord3803 ord800 ord4275 ord692 ord825 ord567 ord3577 ord4424 ord4627 ord4080 ord3079 ord3825 ord3831 ord3830 ord2976 ord3081 ord2985 ord3262 ord3136 ord4465 ord3259 ord3147 ord2982 ord5277 ord2124 ord2446 ord5261 ord1727 ord5065 ord3749 ord6376 ord2055 ord2648 ord4441 ord4837 ord3798 ord5290 ord4353 ord6374 ord5163 ord2385 ord5241 ord4397 ord1776 ord4078 ord6055 ord2024 ord2413 ord6366 ord1771 ord4644 ord4129 ord4163

msvcrt

_controlfp _except_handler3 _setmbcp __CxxFrameHandler _mbscmp free malloc wcscpy wcslen _ftol memmove _mbsnbcpy _strdup strtoul fclose fwrite fseek fopen __dllonexit _onexit _exit _XcptFilter exit _acmdln __getmainargs _initterm __setusermatherr _adjust_fdiv __p__commode __p__fmode __set_app_type

kernel32

GetStartupInfoA GetModuleHandleA CopyFileA DeleteFileA GetModuleFileNameA GetTempPathA GetProfileStringA CreateProcessA WaitForSingleObject WriteProfileStringA WideCharToMultiByte lstrlenW MultiByteToWideChar GetVersionExA GetVersion lstrlenA GetCPInfo LockResource LoadResource FindResourceA lstrcmpiA GetPrivateProfileStringA CreateEventA CloseHandle WinExec SetEvent ResetEvent

user32

GetActiveWindow WindowFromPoint ClientToScreen InflateRect OffsetRect DrawStateA CreateIconIndirect GetIconInfo LoadImageA FrameRect LoadBitmapA GetSysColorBrush GetMenuStringA CreateMenu CreatePopupMenu GetMenuItemID GetMenuState ModifyMenuA GetMenuItemCount AppendMenuA SetCursor GetDC DrawTextA ReleaseDC DrawIconEx DestroyIcon SystemParametersInfoA CopyRect FillRect DrawEdge SetRect GetMenuItemInfoA KillTimer SetTimer IsIconic GetSystemMetrics GetClientRect DrawIcon InvalidateRect PostMessageA GetWindowRect LoadIconA EnableWindow SendMessageA GetParent GetNextDlgTabItem IsMenu GetWindowLongA DestroyCursor GetSysColor TabbedTextOutA GrayStringA DrawFocusRect GetDesktopWindow GetSubMenu

gdi32

GetDeviceCaps StretchBlt CreateBitmap SetBkColor GetStockObject Escape ExtTextOutA TextOutA RectVisible PtVisible PatBlt GetObjectA GetPixel SetPixel CreateDIBSection SelectObject BitBlt DeleteObject DeleteDC Ellipse GetTextExtentPoint32A GetTextExtentPoint32W CreateCompatibleBitmap CreateCompatibleDC CreateFontIndirectA CreatePen GetBkMode CreateFontA CreateSolidBrush

advapi32

RegQueryValueExA RegOpenKeyExA RegCloseKey

shell32

ShellExecuteExA ShellExecuteA SHBrowseForFolderA SHGetPathFromIDListA

comctl32

ImageList_GetIcon ImageList_GetImageCount _TrackMouseEvent ImageList_AddMasked ImageList_ReplaceIcon ImageList_Draw

ole32

CoUninitialize CoCreateInstance CoInitialize

urlmon

URLDownloadToFileA URLOpenBlockingStreamA

winmm

PlaySoundA