jaffacakes118_not-a-virus[.]HEUR[.]AdWare[.]Win32[.]Burden[.]gen[.]0a6aeb1103bb6a1ddc918339441db385

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Burden.gen.0a6aeb1103bb6a1ddc918339441db385
Size 1.2MB
Sample261014-enqlmsft7t
SHA256 081f97d22187a3b993b37f06889932e7d3bcf0004b13752c927e6fea94cb9d76
MD5 0a6aeb1103bb6a1ddc918339441db385
SHA1 cb8227093fe8dd0fed52c67b5b47a7b082f71546
SHA512 acc777740024a6e89acf338a956a48addc1bd3c216e7b795b7ccf11890ff21aea1dfcdde70a3603fe19e253babaf54b04197695c3b3db7a108c65e0ad2f5b831
SSDEEP 24576:bOcEidAmt+Le0ttQIrqkuYSe8bRM+sJaSeoXs:PEiOmMvwI+kIRM/ays
TLSH
T17B457B117A90D0F1E5B301308EFB66BA597C7D22172584FBA3C4F9281DBF8E16634A5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Burden.gen.0a6aeb1103bb6a1ddc918339441db385

.exe 1.2MB

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Burden.gen.0a6aeb1103bb6a1ddc918339441db385

IMPHASH 6c3491de4f2cc24f7de8b4a2813f10d2
SHA256 081f97d22187a3b993b37f06889932e7d3bcf0004b13752c927e6fea94cb9d76
MD5 0a6aeb1103bb6a1ddc918339441db385
SHA1 cb8227093fe8dd0fed52c67b5b47a7b082f71546
SHA512 acc777740024a6e89acf338a956a48addc1bd3c216e7b795b7ccf11890ff21aea1dfcdde70a3603fe19e253babaf54b04197695c3b3db7a108c65e0ad2f5b831
SSDEEP 24576:bOcEidAmt+Le0ttQIrqkuYSe8bRM+sJaSeoXs:PEiOmMvwI+kIRM/ays
TLSH
T17B457B117A90D0F1E5B301308EFB66BA597C7D22172584FBA3C4F9281DBF8E16634A5B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

c1:0e:db:3f:b8:11:a7:2f:d5:b4:30:6d:2b:65:b6:75:bc:73:75:1e:22:12:82:7f:46:5f:a9:87:ca:bf:93:a4

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Shanghai Oriental Webcasting Co. Ltd.,OU=IT,O=Shanghai Oriental Webcasting Co. Ltd.,L=Shanghai,ST=Shanghai,C=CN

Chains

Jun 18, 2019

CN=Shanghai Oriental Webcasting Co. Ltd.,OU=IT,O=Shanghai Oriental Webcasting Co. Ltd.,L=Shanghai,ST=Shanghai,C=CN

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

2d:64:8a:8c:ac:55:58:e3:6e:e5:36:71:15:0c:ca:bb:1f:7c:e0:a6

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Shanghai Oriental Webcasting Co. Ltd.,OU=IT,O=Shanghai Oriental Webcasting Co. Ltd.,L=Shanghai,ST=Shanghai,C=CN

Chains

Jun 18, 2019

CN=Shanghai Oriental Webcasting Co. Ltd.,OU=IT,O=Shanghai Oriental Webcasting Co. Ltd.,L=Shanghai,ST=Shanghai,C=CN

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:2f:4e:e1:52:d7

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 13, 2011 - Jan 28, 2028

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Serial Number

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 24, 2016 - Jun 24, 2027

Subject

CN=Shanghai Oriental Webcasting Co. Ltd.,OU=IT,O=Shanghai Oriental Webcasting Co. Ltd.,L=Shanghai,ST=Shanghai,C=CN

Serial Number

30:05:7d:6e:26:0d:0a:17:ff:ad:1b:da:f6:67:eb:f4

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 13, 2017 - Nov 12, 2019

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Shanghai Oriental Webcasting Co. Ltd.,OU=IT,O=Shanghai Oriental Webcasting Co. Ltd.,L=Shanghai,ST=Shanghai,C=CN

Serial Number

4f:15:bf:0d:75:ea:66:90:38:08:05:c5:e4:5c:fa:82

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 13, 2017 - Nov 12, 2019

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

Major OS version

Entry point

341238

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

F:\svn\LiuLanQi\ChengXu\Trunk\Bin\pdbmap\Pudding\WnSoftUpd.pdb

kernel32

HeapAlloc DecodePointer HeapDestroy DeleteCriticalSection GetProcessHeap RaiseException InterlockedDecrement LeaveCriticalSection InterlockedIncrement LoadLibraryExW TerminateThread HeapReAlloc HeapSize EnterCriticalSection InitializeCriticalSectionAndSpinCount HeapFree FindResourceW LoadResource LockResource SizeofResource ReleaseMutex CreateMutexW CreateThread SetUnhandledExceptionFilter Sleep GetPrivateProfileIntW GetExitCodeProcess GlobalUnlock GetTickCount lstrcmpiW VerifyVersionInfoW WideCharToMultiByte CopyFileW FreeLibrary GetModuleHandleW CreateProcessW GetCurrentProcessId VerSetConditionMask GetFileSize MoveFileExW GlobalLock GetProcAddress GetLocalTime LoadLibraryW CloseHandle Process32FirstW DeleteFileW GlobalAlloc FileTimeToSystemTime Process32NextW GetLastError GetExitCodeThread MultiByteToWideChar CreateToolhelp32Snapshot GetVersionExW GetCurrentThreadId CreateFileW WaitForSingleObject FindClose GetTempPathW GetCurrentProcess FindNextFileW GetCommandLineW FindFirstFileW ReadFile CreateDirectoryW SetEndOfFile WriteConsoleW FlushFileBuffers GetFullPathNameW SetStdHandle SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW ReadConsoleW GetConsoleMode GetConsoleCP EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeZoneInformation SetFilePointerEx FreeLibraryAndExitThread ExitThread SystemTimeToTzSpecificLocalTime GetDriveTypeW GetModuleHandleExW RtlUnwind GetSystemDirectoryW ExpandEnvironmentStringsA PeekNamedPipe GetStdHandle WaitForMultipleObjects FormatMessageA SleepEx InitializeCriticalSection OutputDebugStringW InitializeSListHead QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess UnhandledExceptionFilter WaitForSingleObjectEx ResetEvent SetEvent GetPrivateProfileStringW GetModuleFileNameW WritePrivateProfileStringW EncodePointer SetLastError CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo GetCurrentDirectoryW GetACP MulDiv FreeResource ExitProcess GetFileType WriteFile SetFilePointer SetFileTime DuplicateHandle SystemTimeToFileTime DosDateTimeToFileTime

user32

GetFocus GetWindowRect PostMessageW SetWindowLongW LoadCursorW MoveWindow ShowWindow RegisterClassExW CreateWindowExW SetWindowPos DestroyWindow DefWindowProcW GetWindowLongW PtInRect GetMonitorInfoW GetClientRect PostQuitMessage CharNextW GetDesktopWindow GetParent GetMessageW GetWindowTextW DispatchMessageW SendMessageW IsWindow IsZoomed SetFocus GetKeyState SetCapture ReleaseCapture SetTimer KillTimer GetDC ReleaseDC BeginPaint EndPaint GetUpdateRect InvalidateRect GetCursorPos ScreenToClient MapWindowPoints IsRectEmpty GetWindow SetCursor InflateRect OffsetRect CallWindowProcW RegisterClassW GetClassInfoExW GetMenu SetPropW GetPropW AdjustWindowRectEx MonitorFromWindow IsIconic SetWindowRgn MessageBoxW DrawTextW IntersectRect MonitorFromPoint CharPrevW FillRect SetRect CreateCaret HideCaret ShowCaret SetCaretPos GetCaretPos ClientToScreen GetSysColor SetWindowTextW GetWindowTextLengthW CreateAcceleratorTableW InvalidateRgn TranslateMessage EnableWindow

gdi32

CreateFontIndirectW CreatePen CreateCompatibleBitmap Rectangle RestoreDC SaveDC GetTextMetricsW GetObjectW SetWindowOrgEx CreateRoundRectRgn SetBkMode SetTextColor GetDeviceCaps CombineRgn CreatePenIndirect CreateRectRgnIndirect CreateSolidBrush GetCharABCWidthsW GetClipBox GetTextExtentPoint32W LineTo SelectClipRgn ExtSelectClipRgn SetBkColor StretchBlt SetStretchBltMode MoveToEx TextOutW DeleteObject DeleteDC CreateCompatibleDC CreateDIBSection SelectObject GetObjectA BitBlt GetStockObject

advapi32

CryptDestroyHash CryptReleaseContext CryptDestroyKey CryptHashData RegQueryInfoKeyW RegDeleteKeyW RegEnumKeyExW RegDeleteValueW RegEnumKeyW RegSetValueExW RegOpenKeyW RegCloseKey RegCreateKeyExW RegOpenKeyExW RegQueryValueExW CryptCreateHash CryptEncrypt CryptImportKey CryptGetHashParam CryptAcquireContextW

shell32

ShellExecuteW SHGetSpecialFolderPathW ShellExecuteExW

ole32

OleLockRunning CLSIDFromProgID CLSIDFromString RevokeDragDrop RegisterDragDrop CoTaskMemRealloc OleInitialize CoTaskMemFree CoTaskMemAlloc OleUninitialize CreateStreamOnHGlobal CoCreateInstance CoUninitialize CoInitialize

oleaut32

SysFreeString VarUI4FromStr SysAllocString VariantInit VariantClear

gdiplus

GdipAddPathLineI GdipAddPathArcI GdipCreatePen1 GdipDeletePen GdipSetPenMode GdipGetImageGraphicsContext GdipGetImagePixelFormat GdipDisposeImage GdipBitmapLockBits GdipBitmapUnlockBits GdipSetCompositingMode GdipSetCompositingQuality GdipSetSmoothingMode GdipSetPixelOffsetMode GdipSetInterpolationMode GdipDrawRectangleI GdipDrawPath GdipFillRectangleI GdipDeletePath GdipCreateFontFamilyFromName GdipDeleteFontFamily GdipCreateFont GdipStringFormatGetGenericTypographic GdipCloneStringFormat GdipLoadImageFromStream GdipLoadImageFromStreamICM GdipImageGetFrameDimensionsCount GdipImageGetFrameDimensionsList GdipImageGetFrameCount GdipImageSelectActiveFrame GdipGetPropertyItemSize GdipGetPropertyItem GdipDrawArcI GdipFree GdipCreateFromHDC GdipDeleteGraphics GdipGetImageWidth GdipCreatePath GdipDrawImageRectI GdipCreateBitmapFromHBITMAP GdipCreateLineBrushI GdiplusShutdown GdiplusStartup GdipCreateBitmapFromStreamICM GdipAlloc GdipCreateBitmapFromStream GdipCloneImage GdipGetImageHeight GdipSetStringFormatFlags GdipSetStringFormatAlign GdipDeleteFont GdipDeleteBrush GdipCreateSolidFill GdipDrawString GdipSetTextRenderingHint GdipCloneBrush GdipCreateStringFormat GdipCreateFontFromLogfontA GdipSetStringFormatLineAlign GdipSetStringFormatTrimming GdipCreateFontFromDC GdipMeasureString GdipDrawImageRectRect GdipDeleteStringFormat GdipDrawImageRectRectI GdipCreateBitmapFromScan0

shlwapi

ord219 PathFileExistsW

comctl32

_TrackMouseEvent ord17

imm32

ImmGetContext ImmSetCompositionWindow ImmReleaseContext

ws2_32

ioctlsocket listen accept sendto recvfrom freeaddrinfo getaddrinfo WSAIoctl socket setsockopt ntohs htons getsockopt getsockname getpeername connect closesocket bind send recv WSASetLastError select __WSAFDIsSet WSAGetLastError WSACleanup WSAStartup gethostname

wldap32

ord127 ord27 ord167 ord145 ord142 ord79 ord133 ord147 ord46 ord301 ord26 ord14 ord216 ord208 ord41 ord118

Name

.text

Size

778KB

Virtual Size

777KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

201KB

Virtual Size

200KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

388B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

158KB

Virtual Size

158KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

39KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=23, id=241, version=40116,

count=186, id=243, version=40116,

count=32, id=242, version=40116,

count=2, id=261, version=23013,

count=7, id=199, version=41118,

count=25, id=259, version=24123,

count=84, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=62, id=261, version=24123,

count=36, id=260, version=24123,

count=15, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=479, id=1, productName=Unmarked objects,

count=44, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=22, id=265, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,