jaffacakes118_not-a-virus[.]HEUR[.]AdWare[.]Win32[.]DownloadHelper[.]gen[.]1f50e0f7ec13f265613ca7b8dd0d905f

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.1f50e0f7ec13f265613ca7b8dd0d905f
Size 855KB
Sample261014-eqqdnavy9l
SHA256 47091b8a7571f9ae43e894bd5ac6b5306dd49cdbd965e2a3d85cdadf43db998f
MD5 1f50e0f7ec13f265613ca7b8dd0d905f
SHA1 ec7ac6181b2a5f5f07c7dae1d33524d21e041985
SHA512 1281189d9598f9b93c77704861efc3bb36af9a8641617cd8f075d0c7dc74b991e0561f3ae74362a4e58dbbf72b8abcd162c7f0ea438a1f746ceeb34b2cb70ec8
SSDEEP 12288:/pqdlt78QfSOKvCe2N+mUyVwm+5xjPGcEKFxFs+qOFx5CCjojuwxOr2DHJrvMfd0:Be58wSrCdBVwl4KFxFwuunuwxOYYl3
TLSH
T1E415220375D1D87EE4BA0B732CF66816A269FC964B325CC337E0606E18343C19A75BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.1f50e0f7ec13f265613ca7b8dd0d905f

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.1f50e0f7ec13f265613ca7b8dd0d905f

.exe 855KB

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.1f50e0f7ec13f265613ca7b8dd0d905f

IMPHASH e110f75841da32af098d184cd73b9d9e
SHA256 47091b8a7571f9ae43e894bd5ac6b5306dd49cdbd965e2a3d85cdadf43db998f
MD5 1f50e0f7ec13f265613ca7b8dd0d905f
SHA1 ec7ac6181b2a5f5f07c7dae1d33524d21e041985
SHA512 1281189d9598f9b93c77704861efc3bb36af9a8641617cd8f075d0c7dc74b991e0561f3ae74362a4e58dbbf72b8abcd162c7f0ea438a1f746ceeb34b2cb70ec8
SSDEEP 12288:/pqdlt78QfSOKvCe2N+mUyVwm+5xjPGcEKFxFs+qOFx5CCjojuwxOr2DHJrvMfd0:Be58wSrCdBVwl4KFxFwuunuwxOYYl3
TLSH
T1E415220375D1D87EE4BA0B732CF66816A269FC964B325CC337E0606E18343C19A75BA7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

26941

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

user32

GetMonitorInfoW WinHelpW SetScrollInfo MapDialogRect DestroyCursor GetClassNameW FillRect EnableScrollBar TrackPopupMenu GetMenuItemID GetSystemMetrics SetCapture CharUpperW RegisterWindowMessageW ActivateKeyboardLayout

kernel32

HeapSize GlobalLock VirtualAlloc HeapDestroy GetCurrentThreadId GetLastError LoadResource CloseHandle GetSystemInfo lstrlenW TlsAlloc GetModuleFileNameW ExpandEnvironmentStringsW FindResourceExW CreateDirectoryW GetOEMCP MulDiv LCMapStringW GetStringTypeW HeapReAlloc HeapAlloc OutputDebugStringW RtlUnwind LoadLibraryExW IsProcessorFeaturePresent IsDebuggerPresent GetCPInfo GetACP IsValidCodePage HeapFree LeaveCriticalSection EnterCriticalSection FlushFileBuffers GetConsoleCP GetConsoleMode SetStdHandle SetFilePointerEx WriteConsoleW GetThreadLocale SetLastError GetCommandLineW CreateFileW EncodePointer DecodePointer ExitProcess GetModuleHandleExW GetProcAddress MultiByteToWideChar WideCharToMultiByte GetProcessHeap GetStdHandle GetFileType DeleteCriticalSection GetStartupInfoW WriteFile QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount Sleep GetCurrentProcess TerminateProcess TlsGetValue TlsSetValue TlsFree GetModuleHandleW

comdlg32

GetFileTitleW ReplaceTextW

oleaut32

CreateErrorInfo SetErrorInfo RegisterTypeLi VarBoolFromStr VarBstrFromBool VarBstrFromDate VarBstrFromCy VarCyFromStr VarDateFromStr VarR8FromStr VariantChangeType VariantCopy SafeArrayPutElement SafeArrayUnaccessData SafeArrayAccessData SafeArrayGetUBound SysAllocStringLen

comctl32

FlatSB_GetScrollInfo _TrackMouseEvent ImageList_GetIconSize ImageList_DragShowNolock ImageList_Copy ImageList_GetIcon ImageList_GetBkColor ImageList_GetImageCount CreatePropertySheetPageW InitializeFlatSB