jaffacakes118_not-a-virus[.]HEUR[.]AdWare[.]Win32[.]DownloadHelper[.]gen[.]2dbcdb8e6396c80c477aa0b0c729ecc8

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.2dbcdb8e6396c80c477aa0b0c729ecc8
Size 909KB
Sample261014-ernw8afv2w
SHA256 d0ec32af970f226f73420682a1e87deaf682c6c26b716cf840be267684590e19
MD5 2dbcdb8e6396c80c477aa0b0c729ecc8
SHA1 cb5146182f83c928899f1a3b2c70d42517623562
SHA512 0bd526bcdd3cfe6e5b0951517730c49db9d0e405fcac2026084c3199d835d83c37193e1686b8d8bb285efd8d686676089378ca399d8fb484ff7ebe286156f69e
SSDEEP 12288:ptiz1bm/NEA4UWWhPVygUoDATSeWN4GywgGu7Iixj79VLN+UEhj6L6q+h52Oa22d:pCMLhPQuDATAEwgGu7Icj79WFF5
TLSH
T1F615230336C21476E5E543720CB6995987ECF8B22BB5CCDF26C0695E13F02C1DA7A7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.2dbcdb8e6396c80c477aa0b0c729ecc8

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.2dbcdb8e6396c80c477aa0b0c729ecc8

.exe 909KB

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.2dbcdb8e6396c80c477aa0b0c729ecc8

IMPHASH f23756a80de9df0043fb0d4a7c71935d
SHA256 d0ec32af970f226f73420682a1e87deaf682c6c26b716cf840be267684590e19
MD5 2dbcdb8e6396c80c477aa0b0c729ecc8
SHA1 cb5146182f83c928899f1a3b2c70d42517623562
SHA512 0bd526bcdd3cfe6e5b0951517730c49db9d0e405fcac2026084c3199d835d83c37193e1686b8d8bb285efd8d686676089378ca399d8fb484ff7ebe286156f69e
SSDEEP 12288:ptiz1bm/NEA4UWWhPVygUoDATSeWN4GywgGu7Iixj79VLN+UEhj6L6q+h52Oa22d:pCMLhPQuDATAEwgGu7Icj79WFF5
TLSH
T1F615230336C21476E5E543720CB6995987ECF8B22BB5CCDF26C0695E13F02C1DA7A7A9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

36829

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

FlushFileBuffers LCMapStringW HeapSize HeapReAlloc HeapAlloc OutputDebugStringW RtlUnwind LoadLibraryExW IsProcessorFeaturePresent IsDebuggerPresent GetOEMCP GetACP IsValidCodePage HeapFree LeaveCriticalSection GetConsoleCP GetModuleHandleW TlsFree TlsSetValue TlsGetValue TlsAlloc TerminateProcess GetCurrentProcess Sleep InitializeCriticalSectionAndSpinCount SetUnhandledExceptionFilter UnhandledExceptionFilter FreeEnvironmentStringsW GetEnvironmentStringsW GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter WriteFile GetModuleFileNameW GetStartupInfoW DeleteCriticalSection GetFileType GetStdHandle GetConsoleMode SetStdHandle SetFilePointerEx WriteConsoleW GetStringTypeW WideCharToMultiByte GetCPInfo GetVersionExW DeleteFileW GetVersion CloseHandle SetEndOfFile EnterCriticalSection GetLastError VirtualAlloc GetProcessHeap MultiByteToWideChar GetCommandLineW SetLastError GetCurrentThreadId EncodePointer DecodePointer ExitProcess GetModuleHandleExW GetProcAddress CreateFileW

user32

GetScrollInfo GetIconInfo WindowFromPoint ClientToScreen GetCursorPos SetScrollPos BeginPaint ReleaseDC GetDC SetForegroundWindow GetFocus RegisterClipboardFormatW PostThreadMessageW PostMessageW ExitWindowsEx GetSysColorBrush

oleaut32

SafeArrayCreate SafeArrayRedim SafeArrayGetUBound SafeArrayGetLBound SysStringLen SafeArrayGetElement SafeArrayPutElement SafeArrayPtrOfIndex VariantCopy SysFreeString SysAllocStringLen SafeArrayUnaccessData CreateErrorInfo GetErrorInfo SetErrorInfo RegisterTypeLi LoadTypeLi VarNot VarBstrFromBool VarBstrFromDate VarBstrFromCy VarCyFromStr VarI4FromStr VariantCopyInd

mpr

WNetGetUniversalNameW WNetGetConnectionW

setupapi

SetupDiCreateDeviceInfoList SetupDiGetSelectedDriverW SetupDiGetDeviceInstallParamsW SetupInstallFromInfSectionW CM_Get_DevNode_Registry_Property_ExW CM_Get_DevNode_Status SetupFindFirstLineW SetupDiSetClassInstallParamsW SetupCloseInfFile

crypt32

CertGetPublicKeyLength CertFreeCertificateChain CertNameToStrW CryptExportPKCS8 CryptExportPublicKeyInfo CertFindExtension CertControlStore CertAddStoreToCollection CertGetCertificateContextProperty CertSetCertificateContextProperty CertCreateCertificateContext CertOpenStore CryptMsgClose CryptDecodeObject CryptEncodeObject CryptEncodeObjectEx

psapi

GetMappedFileNameW GetDeviceDriverFileNameW