jaffacakes118_not-a-virus[.]HEUR[.]AdWare[.]Win32[.]DownloadHelper[.]gen[.]2b8be3fa94ba230d404702ce918df10f

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.2b8be3fa94ba230d404702ce918df10f
Size 1011KB
Sample261014-erdfgsfv2t
SHA256 f99e9ea2800274ac24da28c868fdd3c872f9386d86a6f0745600e72a25c1a857
MD5 2b8be3fa94ba230d404702ce918df10f
SHA1 95299410b97fb80e7f77b16a5ebc3cc258521742
SHA512 015b78aba68d89434e0c3cb33d1390b4919e1e4bae59cd3c4369d8f5b47b7c4ce4fb55bfb78f340371b86a78fffbb67b866139a8baaa0c411442395b0babe44a
SSDEEP 24576:oX+YjEJ3yhKV+4epLw7oh54PX+rgE2Hgz:oOYy+0ip9+/+3
TLSH
T1D4251271F9D0943DC822453A8DB51D904BBBFA3297810A5767AF5E3FAB320C0D619B27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.2b8be3fa94ba230d404702ce918df10f

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.2b8be3fa94ba230d404702ce918df10f

.exe 1011KB

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.2b8be3fa94ba230d404702ce918df10f

IMPHASH 2b81dba0403a9306ce45fc4e37b16ecb
SHA256 f99e9ea2800274ac24da28c868fdd3c872f9386d86a6f0745600e72a25c1a857
MD5 2b8be3fa94ba230d404702ce918df10f
SHA1 95299410b97fb80e7f77b16a5ebc3cc258521742
SHA512 015b78aba68d89434e0c3cb33d1390b4919e1e4bae59cd3c4369d8f5b47b7c4ce4fb55bfb78f340371b86a78fffbb67b866139a8baaa0c411442395b0babe44a
SSDEEP 24576:oX+YjEJ3yhKV+4epLw7oh54PX+rgE2Hgz:oOYy+0ip9+/+3
TLSH
T1D4251271F9D0943DC822453A8DB51D904BBBFA3297810A5767AF5E3FAB320C0D619B27
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

32865

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

wintrust

CryptCATAdminReleaseContext CryptCATAdminAcquireContext WTHelperGetProvCertFromChain WTHelperGetProvSignerFromChain CryptCATCatalogInfoFromContext

kernel32

GetModuleHandleExW CloseHandle WriteConsoleW SetFilePointerEx SetStdHandle GetConsoleMode GetProcAddress VirtualAlloc GetCurrentProcessId FreeEnvironmentStringsW GetCurrentThreadId GetLastError InitializeCriticalSection ReleaseSemaphore LoadResource GetSystemTime GetSystemInfo FileTimeToSystemTime lstrlenW LoadLibraryW FindResourceExW CreateDirectoryW GetFileAttributesW GetACP MultiByteToWideChar WideCharToMultiByte LCMapStringW GetStringTypeW GetConsoleCP FlushFileBuffers HeapSize HeapReAlloc HeapAlloc OutputDebugStringW RtlUnwind LoadLibraryExW IsProcessorFeaturePresent IsDebuggerPresent GetCPInfo GetOEMCP IsValidCodePage GetCommandLineW SetLastError EncodePointer DecodePointer ExitProcess CreateFileW GetProcessHeap GetStdHandle GetFileType DeleteCriticalSection GetStartupInfoW GetModuleFileNameW WriteFile QueryPerformanceCounter GetSystemTimeAsFileTime GetEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount Sleep GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW EnterCriticalSection LeaveCriticalSection HeapFree

secur32

FreeContextBuffer DeleteSecurityContext QuerySecurityPackageInfoW

mpr

WNetOpenEnumW WNetGetUniversalNameW

ole32

CreateStreamOnHGlobal CoTaskMemAlloc ReleaseStgMedium

shlwapi

PathIsURLW PathIsRootW PathGetDriveNumberW PathSkipRootW PathFileExistsW StrCmpIW StrStrIW StrRChrW PathStripToRootW PathFindNextComponentW