jaffacakes118_not-a-virus[.]HEUR[.]AdWare[.]Win32[.]DownloadHelper[.]gen[.]2bd5e6a5f2f65d7137159d0406f46add

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.2bd5e6a5f2f65d7137159d0406f46add
Size 2.2MB
Sample261014-erhefaed66
SHA256 96ca7ab30adfecfa9c4109ee33a971ee63480092382422b290a77fd5fb039a3b
MD5 2bd5e6a5f2f65d7137159d0406f46add
SHA1 71ff659c7b4b49d23b600b3dd4d3f1d78f77e011
SHA512 813ac303b8fb4e31db23c9eb0ea39893dfa1ebe955ec3c912b229fa28facf49b353442c5a0a7bb3560ed3acbe2e67e9e220add3307c17f7ce3a64f2b41ba592a
SSDEEP 12288:cE5ElvdfGsuE9WoRPZdx09we0s6afYvxzykcgwAznGPWJwnsUISwSIyZShYKW8Nt:t6u0lPv+9wykIgwjzsPpBs+QiLF
TLSH
T173B512016E43D313E4E7ADF58150950A63E86C507A25CE8737D0BEED7B72393EA25E22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.2bd5e6a5f2f65d7137159d0406f46add

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.2bd5e6a5f2f65d7137159d0406f46add

.exe 2.2MB

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.2bd5e6a5f2f65d7137159d0406f46add

IMPHASH 036ad71a78c13ab018074d1b7b3b0105
SHA256 96ca7ab30adfecfa9c4109ee33a971ee63480092382422b290a77fd5fb039a3b
MD5 2bd5e6a5f2f65d7137159d0406f46add
SHA1 71ff659c7b4b49d23b600b3dd4d3f1d78f77e011
SHA512 813ac303b8fb4e31db23c9eb0ea39893dfa1ebe955ec3c912b229fa28facf49b353442c5a0a7bb3560ed3acbe2e67e9e220add3307c17f7ce3a64f2b41ba592a
SSDEEP 12288:cE5ElvdfGsuE9WoRPZdx09we0s6afYvxzykcgwAznGPWJwnsUISwSIyZShYKW8Nt:t6u0lPv+9wykIgwjzsPpBs+QiLF
TLSH
T173B512016E43D313E4E7ADF58150950A63E86C507A25CE8737D0BEED7B72393EA25E22
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

55290

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

urlmon

CoInternetCreateSecurityManager CoInternetParseUrl

advapi32

RegSetValueExW

kernel32

SetFilePointerEx WriteConsoleW VirtualAlloc GetWriteWatch HeapSize FreeEnvironmentStringsW GetLastError EnterCriticalSection SetHandleCount SetEndOfFile FileTimeToSystemTime CreateProcessW EnumResourceLanguagesW GetSystemDirectoryW CreateFileW MoveFileWithProgressW ReplaceFileW GetVersionExW MultiByteToWideChar IsValidLocale SetStdHandle GetConsoleMode GetConsoleCP FlushFileBuffers LCMapStringW HeapReAlloc HeapAlloc GetStringTypeW OutputDebugStringW RtlUnwind LoadLibraryExW HeapFree LeaveCriticalSection GetCPInfo GetCommandLineW RaiseException EncodePointer SetLastError GetCurrentThreadId DecodePointer ExitProcess GetModuleHandleExW GetProcAddress CloseHandle WideCharToMultiByte GetProcessHeap GetStdHandle GetFileType DeleteCriticalSection GetStartupInfoW GetModuleFileNameW WriteFile QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount Sleep GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW IsProcessorFeaturePresent IsDebuggerPresent IsValidCodePage GetACP GetOEMCP

user32

DrawEdge OemKeyScan DrawIconEx GetClassNameW GetClassLongW PtInRect DrawFocusRect ClientToScreen GetCursor GetCursorPos GetClientRect SetPropW ShowScrollBar RedrawWindow GetDC TrackPopupMenu GetMenuItemCount GetSystemMetrics

winspool.drv

StartDocPrinterW

rasapi32

RasGetEntryPropertiesW

Name

.text

Size

92KB

Virtual Size

92KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

831KB

Virtual Size

7.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1024B

Virtual Size

724B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.qodaro

Size

319KB

Virtual Size

318KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.cslge

Size

515KB

Virtual Size

514KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.eo528

Size

172KB

Virtual Size

171KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

362KB

Virtual Size

362KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.2bd5e6a5f2f65d7137159d0406f46add

urlmon

advapi32

kernel32

user32

winspool.drv

rasapi32

generic