jaffacakes118_not-a-virus[.]HEUR[.]AdWare[.]Win32[.]DownloadHelper[.]gen[.]39cfef7c23fc0f9ecdf09c8ad8d72e2c

General

Target
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.39cfef7c23fc0f9ecdf09c8ad8d72e2c
Size 3.3MB
Sample261014-er6r2afv21
SHA256 1b3c2bd04f45f8d14a48b232d2bacb81e7b8404e21c5506557c92af763b07b00
MD5 39cfef7c23fc0f9ecdf09c8ad8d72e2c
SHA1 251f679cd24143f329c2b08d604f401d49c94344
SHA512 2ef4e0e4f4acfaf816d8289699e9d01d9bf165ff54e9d143c7d7982081c5c0556bc30de31eebccbe0558c41a0c2e869a2ac03c92c770278c840316879a629f75
SSDEEP 24576:sWJk0lzTrKDo+g3MxoHpMgh0NuCZXil98b0vhxgI7:920pKkXWK
TLSH
T13FF53365B7D0E797D5CF86360E91E3F40BB1BDB49821460730EABF2F38B26619E14894
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.39cfef7c23fc0f9ecdf09c8ad8d72e2c

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.39cfef7c23fc0f9ecdf09c8ad8d72e2c

.exe 3.3MB

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.39cfef7c23fc0f9ecdf09c8ad8d72e2c

IMPHASH 0797261dc8ec85fdab323e0b5a0af8a3
SHA256 1b3c2bd04f45f8d14a48b232d2bacb81e7b8404e21c5506557c92af763b07b00
MD5 39cfef7c23fc0f9ecdf09c8ad8d72e2c
SHA1 251f679cd24143f329c2b08d604f401d49c94344
SHA512 2ef4e0e4f4acfaf816d8289699e9d01d9bf165ff54e9d143c7d7982081c5c0556bc30de31eebccbe0558c41a0c2e869a2ac03c92c770278c840316879a629f75
SSDEEP 24576:sWJk0lzTrKDo+g3MxoHpMgh0NuCZXil98b0vhxgI7:920pKkXWK
TLSH
T13FF53365B7D0E797D5CF86360E91E3F40BB1BDB49821460730EABF2F38B26619E14894
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

10

Major OS version

5

Entry point

3050072

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

user32

GetMonitorInfoW UnionRect InvertRect GetCursorPos InsertMenuItemW

msvcrt

_controlfp _except_handler3 __set_app_type memset _exit __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _acmdln exit _XcptFilter

kernel32

GetStartupInfoA GetModuleHandleA GetThreadLocale LCMapStringW CompareStringW GetProcAddress GlobalAlloc GlobalLock GlobalUnlock GlobalFree VirtualAlloc HeapReAlloc GetProcessHeap GetBinaryTypeW GetCurrentThreadId GetLastError EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount WriteFile SetFilePointer CloseHandle GetSystemTime WideCharToMultiByte GetNamedPipeInfo UnmapViewOfFile TlsAlloc GetModuleHandleW GetCommandLineW GetFullPathNameW DeleteFileW FindNextFileW IsValidCodePage GetOEMCP GetCPInfo MultiByteToWideChar FileTimeToLocalFileTime

shell32

SHCreateDirectoryExW

crypt32

CryptBinaryToStringW CertFreeCertificateChain CryptProtectData CryptQueryObject CryptAcquireCertificatePrivateKey CryptExportPublicKeyInfo CertFindExtension CertGetEnhancedKeyUsage CertControlStore CertFreeCTLContext CertFreeCRLContext CertSetCertificateContextProperty CertCloseStore CertOpenStore CryptMsgOpenToDecode CryptDecodeObjectEx

winspool.drv

SetJobW EnumPrintersW

Sharing