jaffacakes118_not-a-virus[.]HEUR[.]AdWare[.]Win32[.]DownloadHelper[.]gen[.]0a1c9b89470031842c80637c2a935146

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.0a1c9b89470031842c80637c2a935146
Size 2.2MB
Sample261014-en9phsysdv
SHA256 c4e2645293a3cc119a43abf908a7a7ad9516c6646e8708b7ec71723abe2e0c77
MD5 0a1c9b89470031842c80637c2a935146
SHA1 f2e72b7d4012f0861d2a84732d06d9cdac873349
SHA512 1e27df8000168d1571302c8c047143d4c9319eadfb14b571c83779450e501dc2dda0eb13bd07a0ec3a680200e40dbebe5a94bb48a50bd825b400559a47f654ce
SSDEEP 24576:kt4878QlV86XvTbJroDBaQQwZH/Jtp9DNbtcAJdlxBT1bG:ktbGwU8Q/9Jn6Ad1
TLSH
T1B1B512102BC3C577E47E57F25AB1A49A457D7CB09A758ECB33E40D1E09704E2EA22E63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.0a1c9b89470031842c80637c2a935146

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.0a1c9b89470031842c80637c2a935146

.exe 2.2MB

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.0a1c9b89470031842c80637c2a935146

IMPHASH 7cd3b2059c80c333cfdd359cca2d20ff
SHA256 c4e2645293a3cc119a43abf908a7a7ad9516c6646e8708b7ec71723abe2e0c77
MD5 0a1c9b89470031842c80637c2a935146
SHA1 f2e72b7d4012f0861d2a84732d06d9cdac873349
SHA512 1e27df8000168d1571302c8c047143d4c9319eadfb14b571c83779450e501dc2dda0eb13bd07a0ec3a680200e40dbebe5a94bb48a50bd825b400559a47f654ce
SSDEEP 24576:kt4878QlV86XvTbJroDBaQQwZH/Jtp9DNbtcAJdlxBT1bG:ktbGwU8Q/9Jn6Ad1
TLSH
T1B1B512102BC3C577E47E57F25AB1A49A457D7CB09A758ECB33E40D1E09704E2EA22E63
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

35702

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CreateSemaphoreW GetStartupInfoW ExpandEnvironmentStringsW CompareStringW EnumDateFormatsW GetUserDefaultLCID GetStringTypeW GetConsoleWindow CreateEventW lstrcmpiW FileTimeToLocalFileTime GetSystemTimes GetSystemInfo CloseHandle WriteConsoleW SetFilePointerEx SetStdHandle GetConsoleMode GetConsoleCP FlushFileBuffers ReadFile LCMapStringW HeapSize HeapReAlloc HeapAlloc OutputDebugStringW LoadLibraryExW HeapFree EnterCriticalSection GetCPInfo GetOEMCP GetACP IsValidCodePage IsDebuggerPresent IsProcessorFeaturePresent GetModuleHandleW TlsFree TlsSetValue GetFileType ReleaseSemaphore LeaveCriticalSection GetLastError GetEnvironmentStringsW VirtualAlloc LocalAlloc RtlUnwind TlsGetValue TlsAlloc GetCommandLineW RaiseException EncodePointer SetLastError GetCurrentThreadId DecodePointer ExitProcess GetModuleHandleExW GetProcAddress MultiByteToWideChar WideCharToMultiByte GetProcessHeap GetStdHandle DeleteCriticalSection GetModuleFileNameW WriteFile QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount Sleep GetCurrentProcess TerminateProcess CreateFileW

advapi32

RegDeleteKeyW RegEnumValueW RegQueryInfoKeyW RegEnumKeyExW

winspool.drv

AddFormW

user32

GetScrollRange RegisterClassW SystemParametersInfoW IsDialogMessageW LoadStringW LoadIconW LoadBitmapW GetWindowLongW WindowFromPoint MapWindowPoints ClientToScreen MessageBeep MessageBoxW AdjustWindowRectEx CreateWindowExW GetClientRect SetScrollRange ExcludeUpdateRgn SetForegroundWindow SetActiveWindow GetTabbedTextExtentW DrawIcon TrackPopupMenu EnableMenuItem GetQueueStatus RegisterClipboardFormatW CheckDlgButton

winscard

SCardFreeMemory SCardGetStatusChangeW

crypt32

CryptHashCertificate CryptDecodeObjectEx CryptExportPublicKeyInfo CryptExportPKCS8 CryptQueryObject CryptEnumOIDInfo CertGetCertificateContextProperty CertFreeCertificateChain

psapi

GetModuleFileNameExW

Name

.text

Size

73KB

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

1.0MB

Virtual Size

8.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1024B

Virtual Size

724B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.0e0o

Size

531KB

Virtual Size

531KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.iryv

Size

582KB

Virtual Size

581KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.0a1c9b89470031842c80637c2a935146

kernel32

advapi32

winspool.drv

user32

winscard

crypt32

psapi

generic