jaffacakes118_not-a-virus[.]HEUR[.]AdWare[.]Win32[.]BrowseFox[.]gen[.]cd78c31240fa1ca42da601df99752489

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.BrowseFox.gen.cd78c31240fa1ca42da601df99752489
Size 322KB
Sample261014-endbbafz3k
SHA256 80bab789f375b5ca82882e7dcc896a8ce9565f40680e1aefceb9f1f43a90dc38
MD5 cd78c31240fa1ca42da601df99752489
SHA1 c5b470a76879cf85d4c7b09940d4621cc75ab8b3
SHA512 02e699e05fac9e6b61652c7d19ae0e23ad518b91483282b63418ba18fa1f0e1f80e7481c61f64997c1a2531f533748f40521fcd97bd15ce81c6bf1d0f21f4f0b
SSDEEP 6144:5+WYNyZ7JeBVT3DoFFjuvf/toNQ8dqLuJoU0U7Hd8CntQOHHM+HFFTjXdpNnT2wf:5LlZFeBVT3D0Fw/tN8dkmLtpHHHrh72g
TLSH
T19C64128567E894A2FBEB88B144B3BB279675B4646C00E71F93089C5A3C71741FD2CB93
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/i)(r1,,,,0x80,,,.r2)i .s/FilesDir
unpack001/i)(r1,,,,0x80,,,.r2)i .s/file
unpack001/i)(r1,,,,0x80,,,.r2)i .s/gramFilesDir

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.BrowseFox.gen.cd78c31240fa1ca42da601df99752489

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.BrowseFox.gen.cd78c31240fa1ca42da601df99752489

.exe 322KB
i)(r1,,,,0x80,,,.r2)i .s/FilesDir

.dll 11KB
i)(r1,,,,0x80,,,.r2)i .s/file

.dll 11KB
i)(r1,,,,0x80,,,.r2)i .s/gramFilesDir

.dll 11KB

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.BrowseFox.gen.cd78c31240fa1ca42da601df99752489

IMPHASH 1534fd2508cb67deec58fdc36e7a9f42
SHA256 80bab789f375b5ca82882e7dcc896a8ce9565f40680e1aefceb9f1f43a90dc38
MD5 cd78c31240fa1ca42da601df99752489
SHA1 c5b470a76879cf85d4c7b09940d4621cc75ab8b3
SHA512 02e699e05fac9e6b61652c7d19ae0e23ad518b91483282b63418ba18fa1f0e1f80e7481c61f64997c1a2531f533748f40521fcd97bd15ce81c6bf1d0f21f4f0b
SSDEEP 6144:5+WYNyZ7JeBVT3DoFFjuvf/toNQ8dqLuJoU0U7Hd8CntQOHHM+HFFTjXdpNnT2wf:5LlZFeBVT3D0Fw/tN8dkmLtpHHHrh72g
TLSH
T19C64128567E894A2FBEB88B144B3BB279675B4646C00E71F93089C5A3C71741FD2CB93
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

9c:ad:75:b3:31:50:79:84:55:18:65:4d:74:5a:48:b3:60:bd:ad:c5

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Brick Bank,O=Brick Bank,L=Los Angeles,ST=California,C=US

Chains

Nov 4, 2015

CN=Brick Bank,O=Brick Bank,L=Los Angeles,ST=California,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Brick Bank,O=Brick Bank,L=Los Angeles,ST=California,C=US

Serial Number

5c:54:9a:8b:e9:38:09:3e:cd:51:4e:35:a8:60:98:26

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 30, 2015 - Oct 29, 2016

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

14942

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LoadLibraryExW GlobalAlloc GlobalFree MulDiv lstrcmpW lstrcmpiW lstrlenA GetPrivateProfileStringW WritePrivateProfileStringW MoveFileW MultiByteToWideChar WideCharToMultiByte GetFileSize GetTickCount GetModuleFileNameW GetCommandLineW GetTempPathW SetErrorMode GetCurrentProcess ExitProcess GetWindowsDirectoryW CopyFileW GetDiskFreeSpaceW GetModuleHandleW GlobalLock GlobalUnlock lstrcpynA lstrcpynW lstrlenW CreateFileW GetTempFileNameW RemoveDirectoryW CreateProcessW OpenProcess GetVersion GetSystemDirectoryW GetVersionExW GetProcAddress lstrcmpiA lstrcpyA lstrcpyW lstrcatW LoadLibraryA LoadLibraryW lstrcmpA FreeLibrary GetExitCodeProcess Sleep WaitForSingleObject GetLastError CloseHandle WriteFile SetFileTime SetFilePointer SetFileAttributesW ReadFile GetShortPathNameW GetFullPathNameW GetFileAttributesW FindNextFileW ExpandEnvironmentStringsW FindFirstFileW FindClose DeleteFileW CreateDirectoryW CompareFileTime SearchPathW SetCurrentDirectoryW CreateThread

user32

SetWindowPos IsWindowVisible DialogBoxParamW EndDialog CheckDlgButton IsDlgButtonChecked OpenClipboard CloseClipboard SetClipboardData EmptyClipboard GetAsyncKeyState IsWindowEnabled GetSystemMetrics GetSystemMenu CreatePopupMenu EnableMenuItem AppendMenuW TrackPopupMenu GetWindowRect SetCursor ScreenToClient GetSysColor GetWindowLongW CreateWindowExW LoadBitmapW LoadCursorW SystemParametersInfoW wvsprintfW wsprintfA DispatchMessageW PeekMessageW SetDlgItemTextW GetDlgItemTextW CharUpperW CharNextA CharPrevW MessageBoxIndirectW SetWindowTextW SetTimer CreateDialogParamW DestroyWindow LoadImageW FindWindowExW SetWindowLongW InvalidateRect SetForegroundWindow GetClassInfoW RegisterClassW CallWindowProcW GetMessagePos CharNextW SetClassLongW ExitWindowsEx EnableWindow GetDlgItem ShowWindow IsWindow PostQuitMessage SendMessageTimeoutW SendMessageW wsprintfW FillRect GetClientRect EndPaint BeginPaint DrawTextW DefWindowProcW GetDC

gdi32

SetBkColor GetDeviceCaps SetTextColor SetBkMode SelectObject DeleteObject CreateFontIndirectW CreateBrushIndirect

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW SHFileOperationW ShellExecuteW SHGetSpecialFolderLocation

advapi32

RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegCloseKey RegSetValueExW RegQueryValueExW RegOpenKeyExW RegEnumValueW RegEnumKeyW

comctl32

ImageList_Destroy ImageList_Create ord17 ImageList_AddMasked

ole32

CoTaskMemFree OleUninitialize OleInitialize CoCreateInstance

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

Name

.text

Size

30KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

415KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

Virtual Size

5.0MB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

i)(r1,,,,0x80,,,.r2)i .s/FilesDir

IMPHASH 735af6e7c9e2337e1f149e9c0bc6c2dd
SHA256 19227e1d2a655edb5fd419e5b9d99769ca3e8d5a3e08a549c3d21ff935b90de6
MD5 ec539506ff2972b2743d8509420003b2
SHA1 3eb85366aef39567c8bb2c1d855137a6e1a3af90
SHA512 1b79de5ae081c0ce54a26fa68db17ba19f9857cea022db0461b88983876d08d2810967336f17a06da73764f9883190eb78bf66657e0a85431fc11cad60be0de1
SSDEEP 192:UcVawmS09nufUEEUmH+Opt+MadSfhzWokC9EbjKtKa1h:UXhpH+mhaS9WoryCYih
TLSH
T1DE322B01BBA251F5F691413508BB3B374FA8A42106E58E47CF939459AC2B2A13D3A797
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7232

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

i)(r1,,,,0x80,,,.r2)i .s/file

IMPHASH 735af6e7c9e2337e1f149e9c0bc6c2dd
SHA256 19227e1d2a655edb5fd419e5b9d99769ca3e8d5a3e08a549c3d21ff935b90de6
MD5 ec539506ff2972b2743d8509420003b2
SHA1 3eb85366aef39567c8bb2c1d855137a6e1a3af90
SHA512 1b79de5ae081c0ce54a26fa68db17ba19f9857cea022db0461b88983876d08d2810967336f17a06da73764f9883190eb78bf66657e0a85431fc11cad60be0de1
SSDEEP 192:UcVawmS09nufUEEUmH+Opt+MadSfhzWokC9EbjKtKa1h:UXhpH+mhaS9WoryCYih
TLSH
T1DE322B01BBA251F5F691413508BB3B374FA8A42106E58E47CF939459AC2B2A13D3A797
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7232

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

i)(r1,,,,0x80,,,.r2)i .s/gramFilesDir

IMPHASH 735af6e7c9e2337e1f149e9c0bc6c2dd
SHA256 19227e1d2a655edb5fd419e5b9d99769ca3e8d5a3e08a549c3d21ff935b90de6
MD5 ec539506ff2972b2743d8509420003b2
SHA1 3eb85366aef39567c8bb2c1d855137a6e1a3af90
SHA512 1b79de5ae081c0ce54a26fa68db17ba19f9857cea022db0461b88983876d08d2810967336f17a06da73764f9883190eb78bf66657e0a85431fc11cad60be0de1
SSDEEP 192:UcVawmS09nufUEEUmH+Opt+MadSfhzWokC9EbjKtKa1h:UXhpH+mhaS9WoryCYih
TLSH
T1DE322B01BBA251F5F691413508BB3B374FA8A42106E58E47CF939459AC2B2A13D3A797
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7232

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.BrowseFox.gen.cd78c31240fa1ca42da601df99752489

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

i)(r1,,,,0x80,,,.r2)i .s/FilesDir

kernel32

user32

ole32

generic

i)(r1,,,,0x80,,,.r2)i .s/file

kernel32

user32

ole32

generic

i)(r1,,,,0x80,,,.r2)i .s/gramFilesDir

kernel32

user32

ole32

generic