jaffacakes118_not-a-virus[.]HEUR[.]AdWare[.]Win32[.]DownloadHelper[.]gen[.]661071a934c3ddee44d06c85d99d90b2

General

Target
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.661071a934c3ddee44d06c85d99d90b2
Size 2.8MB
Sample261014-es7eysed73
SHA256 a278e8d5aee8086f60e4f3e38510b794adda9d0ff346d0e3c92847ebd9754bcd
MD5 661071a934c3ddee44d06c85d99d90b2
SHA1 82bc31f0533d9110a90024abf18841cff0372efd
SHA512 86734ea1b34a9a315d6942dbd002d8d5550fd510a4cffa6c0c7dd4f57a4b9020c5c1ed650924a9a6380a31ad7fbf2224d5d6fdb5ccfadac0fcdaee0000257b3b
SSDEEP 24576:eYbBUXM5q9U11J1BqjFHhiSj79KwtXjhbKu7UjySLEKsDDcmH:ju8A9IiFhbXXp
TLSH
T1D7D5333097265343E6DEB737D8C5BA850739B7112B20C4E3985422AD7B29CEBD359B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.661071a934c3ddee44d06c85d99d90b2

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.661071a934c3ddee44d06c85d99d90b2

.exe 2.8MB

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.661071a934c3ddee44d06c85d99d90b2

IMPHASH f67dc188ae8bc642f8c4f14a2cb66b79
SHA256 a278e8d5aee8086f60e4f3e38510b794adda9d0ff346d0e3c92847ebd9754bcd
MD5 661071a934c3ddee44d06c85d99d90b2
SHA1 82bc31f0533d9110a90024abf18841cff0372efd
SHA512 86734ea1b34a9a315d6942dbd002d8d5550fd510a4cffa6c0c7dd4f57a4b9020c5c1ed650924a9a6380a31ad7fbf2224d5d6fdb5ccfadac0fcdaee0000257b3b
SSDEEP 24576:eYbBUXM5q9U11J1BqjFHhiSj79KwtXjhbKu7UjySLEKsDDcmH:ju8A9IiFhbXXp
TLSH
T1D7D5333097265343E6DEB737D8C5BA850739B7112B20C4E3985422AD7B29CEBD359B23
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

10

Major OS version

5

Entry point

1666304

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

mpr

WNetGetUniversalNameW WNetGetLastErrorW WNetGetResourceInformationW

comctl32

ImageList_Copy FlatSB_GetScrollInfo CreateStatusWindowW CreateToolbarEx CreatePropertySheetPageW ImageList_Create ImageList_GetBkColor ImageList_AddMasked ImageList_BeginDrag ImageList_DragLeave ImageList_Write ImageList_GetImageInfo

kernel32

GetProcAddress GlobalLock GlobalUnlock VirtualAlloc HeapAlloc HeapReAlloc HeapFree HeapSize GetCurrentThreadId GetLastError GetFileType lstrcmpW TlsAlloc GetModuleHandleA GetStartupInfoA GetCommandLineA GetVersion ExitProcess TerminateProcess GetCurrentProcess UnhandledExceptionFilter GetModuleFileNameA FreeEnvironmentStringsA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStrings GetEnvironmentStringsW SetHandleCount GetStdHandle TlsSetValue SetLastError TlsGetValue GetEnvironmentVariableA GetVersionExA HeapDestroy HeapCreate VirtualFree RtlUnwind WriteFile InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetCPInfo GetACP GetOEMCP LoadLibraryA MultiByteToWideChar LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW InterlockedDecrement InterlockedIncrement

ole32

CoTaskMemAlloc CreateStreamOnHGlobal CLSIDFromString CoGetMalloc PropVariantClear CoTaskMemRealloc

comdlg32

ChooseFontW PageSetupDlgW

Sharing