jaffacakes118_not-a-virus[.]HEUR[.]AdWare[.]Win32[.]DownloadHelper[.]gen[.]163beab27bf340a50d270c1cd1254677

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.163beab27bf340a50d270c1cd1254677
Size 2.6MB
Sample261014-eppezaysez
SHA256 9d68694e6ecbfbfe3487b399a9c4a914553f5e274d8377828ac9d1e5108b7171
MD5 163beab27bf340a50d270c1cd1254677
SHA1 6a81424528f14fb5e0260568840e8f284f1c5382
SHA512 e1444a74fdaa0aeb24041d8356b1210900b808e0c50920cb6dce0859867ec6f9828511b98a9b94c68fa3c07cc7b03dade902b1b5a4ab547ea42b312d9f6590f0
SSDEEP 24576:4jGlN+4r+R3FBkifWc7/hGQVOkbz8XZo/a:4jGl4Zdpl7Z5Vpb6n
TLSH
T13DC5124E7152C8A5C476867A1BB797D00BACBD249E70C9473AC43F5E167C281BC2EFA1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.163beab27bf340a50d270c1cd1254677

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.163beab27bf340a50d270c1cd1254677

.exe 2.6MB

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.163beab27bf340a50d270c1cd1254677

IMPHASH 4dda93eb8f093da5291fbc632f2c95ca
SHA256 9d68694e6ecbfbfe3487b399a9c4a914553f5e274d8377828ac9d1e5108b7171
MD5 163beab27bf340a50d270c1cd1254677
SHA1 6a81424528f14fb5e0260568840e8f284f1c5382
SHA512 e1444a74fdaa0aeb24041d8356b1210900b808e0c50920cb6dce0859867ec6f9828511b98a9b94c68fa3c07cc7b03dade902b1b5a4ab547ea42b312d9f6590f0
SSDEEP 24576:4jGlN+4r+R3FBkifWc7/hGQVOkbz8XZo/a:4jGl4Zdpl7Z5Vpb6n
TLSH
T13DC5124E7152C8A5C476867A1BB797D00BACBD249E70C9473AC43F5E167C281BC2EFA1
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

52876

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

ReleaseSemaphore WaitForMultipleObjects UnlockFile GetFileType SetFilePointer CloseHandle EscapeCommFunction GetSystemTimeAsFileTime FileTimeToLocalFileTime FileTimeToSystemTime CreateMutexW HeapDestroy LoadLibraryExW GetModuleHandleW CreateProcessW GetCommandLineW ExpandEnvironmentStringsW FindResourceW FindResourceExW FindFirstFileExW CompareStringW LCMapStringW VirtualAlloc LocalSize LocalAlloc GlobalUnlock CreateFileMappingW RtlUnwind WriteConsoleW SetFilePointerEx SetStdHandle GetConsoleMode GetConsoleCP FlushFileBuffers HeapSize HeapReAlloc HeapAlloc GetStringTypeW OutputDebugStringW HeapFree LeaveCriticalSection EnterCriticalSection GetCPInfo GetOEMCP GetACP IsValidCodePage IsDebuggerPresent IsProcessorFeaturePresent RaiseException EncodePointer GetLastError SetLastError GetCurrentThreadId DecodePointer ExitProcess GetModuleHandleExW GetProcAddress MultiByteToWideChar WideCharToMultiByte GetProcessHeap GetStdHandle DeleteCriticalSection GetStartupInfoW GetModuleFileNameW WriteFile QueryPerformanceCounter GetCurrentProcessId GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount Sleep GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree CreateFileW

advapi32

RegSetValueExW RegQueryValueExW RegEnumValueW RegEnumKeyExW OpenSCManagerW

user32

DrawFrameControl UnregisterClassW MoveWindow GetDlgItem DdePostAdvise RegisterRawInputDevices GetWindow GetTopWindow FindWindowExW IntersectRect CopyRect FrameRect DrawFocusRect SetCursor SetScrollPos RedrawWindow InvalidateRect GetWindowDC UpdateWindow SetMenuDefaultItem DrawMenuBar EnableWindow IsCharAlphaNumericW CharLowerW GetDlgItemInt

wininet

InternetConnectW HttpAddRequestHeadersW HttpQueryInfoW InternetOpenW

Name

.text

Size

90KB

Virtual Size

89KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

373KB

Virtual Size

7.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1024B

Virtual Size

724B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rg6e

Size

212KB

Virtual Size

211KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.0eipl5

Size

393KB

Virtual Size

392KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fhnde

Size

624KB

Virtual Size

624KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.cefe

Size

390KB

Virtual Size

389KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.otpk

Size

173KB

Virtual Size

173KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

362KB

Virtual Size

362KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.163beab27bf340a50d270c1cd1254677

kernel32

advapi32

user32

wininet

generic