jaffacakes118_not-a-virus[.]HEUR[.]AdWare[.]Win32[.]DownloadHelper[.]gen[.]0821a43c3e830a2e344ddaab78b6e049

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.0821a43c3e830a2e344ddaab78b6e049
Size 2.3MB
Sample261014-en13davy8j
SHA256 ec0df84dcb50220cf0af57aec1f21d7a7080868cd86d73d1e59c8fce07ee3d09
MD5 0821a43c3e830a2e344ddaab78b6e049
SHA1 ae1a2c16800a2274f1826b381984a597ff265868
SHA512 85528fda037f641076c2a01324642f9d1247d6e7a3e377cee1a2c89820d1210a81e93e26f8a27391ecf9701ef5c3fe68dbd95d3a100ebcb9d4d38a3401da3f75
SSDEEP 24576:eol1mwchWdfWS6faj8itQBfNSx/Fm8lAksv8:eolgwcw2fcBISxF
TLSH
T1A7B5CE33EEDD8C7CE85E4EB7D02D85A048FFED20659065A2FE93FE2927352425630925
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.0821a43c3e830a2e344ddaab78b6e049

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.0821a43c3e830a2e344ddaab78b6e049

.exe 2.3MB

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.0821a43c3e830a2e344ddaab78b6e049

IMPHASH af781605dc994d81146bbd997b4ae7a7
SHA256 ec0df84dcb50220cf0af57aec1f21d7a7080868cd86d73d1e59c8fce07ee3d09
MD5 0821a43c3e830a2e344ddaab78b6e049
SHA1 ae1a2c16800a2274f1826b381984a597ff265868
SHA512 85528fda037f641076c2a01324642f9d1247d6e7a3e377cee1a2c89820d1210a81e93e26f8a27391ecf9701ef5c3fe68dbd95d3a100ebcb9d4d38a3401da3f75
SSDEEP 24576:eol1mwchWdfWS6faj8itQBfNSx/Fm8lAksv8:eolgwcw2fcBISxF
TLSH
T1A7B5CE33EEDD8C7CE85E4EB7D02D85A048FFED20659065A2FE93FE2927352425630925
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

67226

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

shlwapi

StrCmpNW UrlCanonicalizeW PathStripToRootW PathRemoveFileSpecW PathRemoveBlanksW StrCmpNIW StrFormatByteSizeW StrStrW PathCanonicalizeW PathFindExtensionW PathFindFileNameW PathFindNextComponentW PathIsRelativeW PathIsUNCW PathIsURLW

user32

SetDlgItemInt ToAsciiEx BringWindowToTop DeferWindowPos SetWindowPos CallWindowProcW AttachThreadInput DrawMenuBar CreateMenu InvalidateRect SetScrollPos GetPropW GetWindowRect AdjustWindowRectEx ShowCursor HideCaret GetSysColor FrameRect SetRect GetWindowLongW GetClassLongW EndDialog

secur32

QuerySecurityPackageInfoW TranslateNameW FreeContextBuffer FreeCredentialsHandle

kernel32

SetLastError CloseHandle WriteConsoleW SetFilePointerEx SetStdHandle GetConsoleMode GetConsoleCP FlushFileBuffers HeapSize HeapReAlloc HeapAlloc GetStringTypeW OutputDebugStringW RtlUnwind LoadLibraryExW LeaveCriticalSection EnterCriticalSection GetCPInfo GetOEMCP GetACP IsValidCodePage IsDebuggerPresent IsProcessorFeaturePresent TlsFree TlsSetValue TlsGetValue TlsAlloc TerminateProcess GetCurrentProcess Sleep InitializeCriticalSectionAndSpinCount SetUnhandledExceptionFilter GlobalLock GlobalFree VirtualAlloc HeapFree GetEnvironmentStringsW LoadResource FormatMessageW lstrcmpW lstrcmpiW CreateMutexW GetModuleHandleW GetTempPathW RemoveDirectoryW GetFullPathNameW CompareStringW LCMapStringW GetConsoleWindow GetCommandLineW RaiseException EncodePointer GetLastError CreateFileW GetCurrentThreadId DecodePointer ExitProcess GetModuleHandleExW GetProcAddress MultiByteToWideChar WideCharToMultiByte GetProcessHeap GetStdHandle GetFileType DeleteCriticalSection GetStartupInfoW GetModuleFileNameW WriteFile QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime FreeEnvironmentStringsW UnhandledExceptionFilter

Name

.text

Size

104KB

Virtual Size

103KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

493KB

Virtual Size

7.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1024B

Virtual Size

724B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.35dk

Size

563KB

Virtual Size

563KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.ax12

Size

568KB

Virtual Size

567KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.o1c6o

Size

266KB

Virtual Size

266KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

362KB

Virtual Size

362KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.0821a43c3e830a2e344ddaab78b6e049

shlwapi

user32

secur32

kernel32

generic