jaffacakes118_not-a-virus[.]HEUR[.]AdWare[.]Win32[.]DownloadHelper[.]gen[.]2335805f5c595c19be4c3943f219bd4e

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.2335805f5c595c19be4c3943f219bd4e
Size 1.6MB
Sample261014-eq3nzsysgs
SHA256 14a210b951fd430a9aa8e1e07e7c071bb82f75cba975fb5bdda123c212013f5e
MD5 2335805f5c595c19be4c3943f219bd4e
SHA1 10022b3abc9d9f6075ba709b0cbf93c3c5c817ff
SHA512 66a7ca08759db547f8de7de181495a77197e6c3df9e81601beea6d63f35457be0643925ef3c71df88a6d8e4a83f5ea9c1ad3e6773bf5234dd6b6b9cab4f18cc2
SSDEEP 24576:ev3ubpoApovbDP4GZt0YWg53zW+XnEAgQyN:evsYbDsOzW0N
TLSH
T19575230833C2C072C9B252F144F48555567ABEA99635C9CB37C12F0E6E386E2E725F97
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.2335805f5c595c19be4c3943f219bd4e

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.2335805f5c595c19be4c3943f219bd4e

.exe 1.6MB

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.2335805f5c595c19be4c3943f219bd4e

IMPHASH 7b47d7e0ea5830b137c09b7ccf4bbf67
SHA256 14a210b951fd430a9aa8e1e07e7c071bb82f75cba975fb5bdda123c212013f5e
MD5 2335805f5c595c19be4c3943f219bd4e
SHA1 10022b3abc9d9f6075ba709b0cbf93c3c5c817ff
SHA512 66a7ca08759db547f8de7de181495a77197e6c3df9e81601beea6d63f35457be0643925ef3c71df88a6d8e4a83f5ea9c1ad3e6773bf5234dd6b6b9cab4f18cc2
SSDEEP 24576:ev3ubpoApovbDP4GZt0YWg53zW+XnEAgQyN:evsYbDsOzW0N
TLSH
T19575230833C2C072C9B252F144F48555567ABEA99635C9CB37C12F0E6E386E2E725F97
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

72886

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

user32

GetTitleBarInfo IsWinEventHookInstalled IsDialogMessageW GetWindow GetClassNameW FindWindowExW FindWindowW SetParent GetWindowLongW OffsetRect CopyRect FrameRect GetSysColor MapWindowPoints GetCursor GetCursorPos SetCursorPos MessageBeep AdjustWindowRect SetWindowRgn GetDCEx GetForegroundWindow EndMenu TrackPopupMenuEx GetMenuItemCount DrawMenuBar GetSystemMetrics EnableWindow ReleaseCapture CharPrevW RegisterClipboardFormatW GetDlgCtrlID CheckDlgButton DispatchMessageW DrawFrameControl

kernel32

CloseHandle WriteConsoleW SetFilePointerEx SetStdHandle GetConsoleMode GetConsoleCP FlushFileBuffers HeapReAlloc HeapAlloc GetStringTypeW OutputDebugStringW RtlUnwind HeapFree LeaveCriticalSection GetCPInfo GetACP IsValidCodePage IsDebuggerPresent IsProcessorFeaturePresent TlsFree TlsSetValue TlsGetValue TlsAlloc TerminateProcess GetCurrentProcess Sleep LocalAlloc LocalSize LocalFree VirtualAlloc HeapSize EnterCriticalSection DeleteCriticalSection GetFileType FindClose CompareFileTime FormatMessageW LoadLibraryExW GetModuleHandleW GetCommandLineW FindResourceW GetFullPathNameW CreateFileW GetFileAttributesW GetOEMCP MultiByteToWideChar LCMapStringW GetLocaleInfoW EnumCalendarInfoExW GetUserDefaultLCID InitializeCriticalSectionAndSpinCount SetUnhandledExceptionFilter UnhandledExceptionFilter FreeEnvironmentStringsW GetEnvironmentStringsW GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter WriteFile GetModuleFileNameW GetStartupInfoW GetStdHandle GetProcessHeap WideCharToMultiByte GetProcAddress GetModuleHandleExW ExitProcess DecodePointer GetCurrentThreadId SetLastError GetLastError EncodePointer RaiseException

oleaut32

CreateErrorInfo RegisterTypeLi VarNot VarBoolFromStr VarBstrFromBool VarBstrFromDate VarBstrFromCy VarCyFromStr VarDateFromStr VarR8FromStr VariantChangeTypeEx VariantCopyInd VariantCopy SafeArrayPutElement SafeArrayGetElement SafeArrayUnaccessData SafeArrayAccessData SafeArrayGetLBound SafeArrayGetUBound SafeArrayRedim SysStringLen SysFreeString SysAllocStringLen VariantChangeType

mprapi

MprConfigTransportGetHandle

Name

.text

Size

109KB

Virtual Size

109KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

466KB

Virtual Size

7.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1024B

Virtual Size

724B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.wi6i

Size

128KB

Virtual Size

128KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.2blao1

Size

827KB

Virtual Size

827KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.o9i9

Size

99KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.2335805f5c595c19be4c3943f219bd4e

user32

kernel32

oleaut32

mprapi

generic