jaffacakes118_not-a-virus[.]HEUR[.]AdWare[.]Win32[.]DownloadHelper[.]gen[.]0683d2bdb373c7359222e91790828b43

General

Target
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.0683d2bdb373c7359222e91790828b43
Size 1.9MB
Sample261014-envklavy6r
SHA256 b03f93ee10bd46ba849e0cf73ebd8087821b6448bb27f93ff738cb0fdb605e0f
MD5 0683d2bdb373c7359222e91790828b43
SHA1 9903f3540798eb4b9078779245e240f5bc8b9f73
SHA512 8a35275cf0243bdc9b187a7fe3bc2378eeebf8775983b8fc1df3eb43c191e44a51ac0319c607d421f180419d8e647da29955d4e307443b671e45159cc19dd7f4
SSDEEP 24576:k8EyGvBGwn98PW+MJa95pwPX17RAdw/zvdWxpRA4OL:kd0wqW+f+7ed8AxpRAl
TLSH
T1AF951241B24CC021F0A311FC7E5A95158A382E725D2978EB2BD1BFDCA4F29C39625ED7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.0683d2bdb373c7359222e91790828b43

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.0683d2bdb373c7359222e91790828b43

.exe 1.9MB

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.0683d2bdb373c7359222e91790828b43

IMPHASH 250d60d7416719cde133474d63adf73f
SHA256 b03f93ee10bd46ba849e0cf73ebd8087821b6448bb27f93ff738cb0fdb605e0f
MD5 0683d2bdb373c7359222e91790828b43
SHA1 9903f3540798eb4b9078779245e240f5bc8b9f73
SHA512 8a35275cf0243bdc9b187a7fe3bc2378eeebf8775983b8fc1df3eb43c191e44a51ac0319c607d421f180419d8e647da29955d4e307443b671e45159cc19dd7f4
SSDEEP 24576:k8EyGvBGwn98PW+MJa95pwPX17RAdw/zvdWxpRA4OL:kd0wqW+f+7ed8AxpRAl
TLSH
T1AF951241B24CC021F0A311FC7E5A95158A382E725D2978EB2BD1BFDCA4F29C39625ED7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

64376

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

VirtualAlloc ExitProcess FreeEnvironmentStringsW GetLastError CreateIoCompletionPort InitializeCriticalSectionAndSpinCount FormatMessageW LoadLibraryW GetModuleHandleW CreateProcessW FindResourceExW GetTempPathW DeleteFileW FindFirstFileExW MoveFileW IsBadWritePtr MultiByteToWideChar EnumUILanguagesW GetConsoleWindow LocalAlloc CloseHandle WriteConsoleW SetFilePointerEx SetStdHandle GetConsoleMode GetConsoleCP FlushFileBuffers LCMapStringW HeapSize HeapReAlloc HeapAlloc GetStringTypeW GlobalUnlock GlobalAlloc FreeResource GetCommandLineW RaiseException EncodePointer SetLastError GetCurrentThreadId DecodePointer GetModuleHandleExW GetProcAddress WideCharToMultiByte GetProcessHeap GetStdHandle GetFileType DeleteCriticalSection GetStartupInfoW GetModuleFileNameW WriteFile QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter Sleep GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree IsProcessorFeaturePresent IsDebuggerPresent IsValidCodePage GetACP GetOEMCP GetCPInfo EnterCriticalSection LeaveCriticalSection HeapFree LoadLibraryExW RtlUnwind OutputDebugStringW CreateFileW

mprapi

MprConfigTransportCreate MprConfigInterfaceTransportGetHandle MprConfigServerDisconnect

user32

GetLastActivePopup SetWindowLongW IntersectRect InflateRect LoadCursorFromFileW GetScrollPos CountClipboardFormats RegisterClipboardFormatW EndDialog UnregisterClassW DdeSetUserHandle DdeUnaccessData DdeFreeDataHandle SetRectEmpty

advapi32

RegEnumValueW RegCloseKey RegQueryInfoKeyW

Name

.text

Size

101KB

Virtual Size

101KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

872KB

Virtual Size

7.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1024B

Virtual Size

724B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.97e6

Size

364KB

Virtual Size

364KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.trc8

Size

527KB

Virtual Size

526KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

101KB

Virtual Size

101KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.0683d2bdb373c7359222e91790828b43

kernel32

mprapi

user32

advapi32

generic