jaffacakes118_not-a-virus[.]HEUR[.]AdWare[.]Win32[.]DownloadHelper[.]gen[.]2c6cfd9a0b390691858b1efff3990de2

General

Target
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.2c6cfd9a0b390691858b1efff3990de2
Size 1.9MB
Sample261014-erj82aed67
SHA256 ad05b545b583b70bbb6025555802555a2bd59ac770d41435735da5398f8fbf2f
MD5 2c6cfd9a0b390691858b1efff3990de2
SHA1 666fc1f52ea5b9e91c31ab3da09c47f42e707637
SHA512 2375e363ebb8170d383bba40f7538dcaefed845fe4844e966c9dc3c8c265c953c5f649f658f9e32030f43d49d5be4362a10628c3ee0caa855fb3eb63e63006de
SSDEEP 24576:kfbQyBeK99WiPfCVsP19wBXoGHFCWEpo1mRA/w/LvdW8pJA4OL:kfbQp2WiCQwBXoo5EOme/4A8pJAl
TLSH
T1B3951240B38CC431F0A305FD3A6A84654A743E305E6678E767E07EED54F2A93A524EE7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.2c6cfd9a0b390691858b1efff3990de2

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.2c6cfd9a0b390691858b1efff3990de2

.exe 1.9MB

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.2c6cfd9a0b390691858b1efff3990de2

IMPHASH 250d60d7416719cde133474d63adf73f
SHA256 ad05b545b583b70bbb6025555802555a2bd59ac770d41435735da5398f8fbf2f
MD5 2c6cfd9a0b390691858b1efff3990de2
SHA1 666fc1f52ea5b9e91c31ab3da09c47f42e707637
SHA512 2375e363ebb8170d383bba40f7538dcaefed845fe4844e966c9dc3c8c265c953c5f649f658f9e32030f43d49d5be4362a10628c3ee0caa855fb3eb63e63006de
SSDEEP 24576:kfbQyBeK99WiPfCVsP19wBXoGHFCWEpo1mRA/w/LvdW8pJA4OL:kfbQp2WiCQwBXoo5EOme/4A8pJAl
TLSH
T1B3951240B38CC431F0A305FD3A6A84654A743E305E6678E767E07EED54F2A93A524EE7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

64376

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

VirtualAlloc ExitProcess FreeEnvironmentStringsW GetLastError CreateIoCompletionPort InitializeCriticalSectionAndSpinCount FormatMessageW LoadLibraryW GetModuleHandleW CreateProcessW FindResourceExW GetTempPathW DeleteFileW FindFirstFileExW MoveFileW IsBadWritePtr MultiByteToWideChar EnumUILanguagesW GetConsoleWindow LocalAlloc CloseHandle WriteConsoleW SetFilePointerEx SetStdHandle GetConsoleMode GetConsoleCP FlushFileBuffers LCMapStringW HeapSize HeapReAlloc HeapAlloc GetStringTypeW GlobalUnlock GlobalAlloc FreeResource GetCommandLineW RaiseException EncodePointer SetLastError GetCurrentThreadId DecodePointer GetModuleHandleExW GetProcAddress WideCharToMultiByte GetProcessHeap GetStdHandle GetFileType DeleteCriticalSection GetStartupInfoW GetModuleFileNameW WriteFile QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter Sleep GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree IsProcessorFeaturePresent IsDebuggerPresent IsValidCodePage GetACP GetOEMCP GetCPInfo EnterCriticalSection LeaveCriticalSection HeapFree LoadLibraryExW RtlUnwind OutputDebugStringW CreateFileW

mprapi

MprConfigTransportCreate MprConfigInterfaceTransportGetHandle MprConfigServerDisconnect

user32

GetLastActivePopup SetWindowLongW IntersectRect InflateRect LoadCursorFromFileW GetScrollPos CountClipboardFormats RegisterClipboardFormatW EndDialog UnregisterClassW DdeSetUserHandle DdeUnaccessData DdeFreeDataHandle SetRectEmpty

advapi32

RegEnumValueW RegCloseKey RegQueryInfoKeyW

Name

.text

Size

101KB

Virtual Size

101KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

872KB

Virtual Size

7.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1024B

Virtual Size

724B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.97e6

Size

364KB

Virtual Size

364KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.trc8

Size

527KB

Virtual Size

526KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

101KB

Virtual Size

101KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.2c6cfd9a0b390691858b1efff3990de2

kernel32

mprapi

user32

advapi32

generic