jaffacakes118_not-a-virus[.]HEUR[.]AdWare[.]Win32[.]DownloadHelper[.]gen[.]671873dfd6f3bd59805b8759aef85dfb

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.671873dfd6f3bd59805b8759aef85dfb
Size 2.2MB
Sample261014-es89jsed75
SHA256 bf0d24b9f1298dc3676c53c74031df6f6e408ff14865656eef7bafba02a29f04
MD5 671873dfd6f3bd59805b8759aef85dfb
SHA1 d572ee9dfd6e3154c43f0df3752139a8734b5ef0
SHA512 1dccc945122df7b0420a296a56092b6ccf6faee09a3174a125f2362d33c65ae983a7bb0a2957a70c33ec9e2371a660f7067ca892361df240cf384c3b51baf2ea
SSDEEP 49152:7bNAkXIrnOSjDIGA+H2jB/zJ7TXiZol7:7ekXSOgHsJ/X3l
TLSH
T11CB5187361C7EA0AE64BCAB9278FD1A6A4097C7055795287B2C7AF732038504875EF33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.671873dfd6f3bd59805b8759aef85dfb

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.671873dfd6f3bd59805b8759aef85dfb

.exe 2.2MB

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.671873dfd6f3bd59805b8759aef85dfb

IMPHASH ef81ceecb7b26a60f9a2f8c01bb4e28f
SHA256 bf0d24b9f1298dc3676c53c74031df6f6e408ff14865656eef7bafba02a29f04
MD5 671873dfd6f3bd59805b8759aef85dfb
SHA1 d572ee9dfd6e3154c43f0df3752139a8734b5ef0
SHA512 1dccc945122df7b0420a296a56092b6ccf6faee09a3174a125f2362d33c65ae983a7bb0a2957a70c33ec9e2371a660f7067ca892361df240cf384c3b51baf2ea
SSDEEP 49152:7bNAkXIrnOSjDIGA+H2jB/zJ7TXiZol7:7ekXSOgHsJ/X3l
TLSH
T11CB5187361C7EA0AE64BCAB9278FD1A6A4097C7055795287B2C7AF732038504875EF33
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1531518

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

user32

DdeFreeStringHandle InvertRect

kernel32

InterlockedExchange InitializeCriticalSection GlobalAlloc WaitForSingleObject CreateEventW GetStartupInfoW GetFullPathNameW lstrcmpiW GlobalLock LoadLibraryExW CloseHandle GetSystemInfo DeleteFileW InitializeCriticalSectionAndSpinCount FindFirstFileW VirtualAlloc GetTimeZoneInformation GetUserDefaultLangID CreateFileMappingW CreateDirectoryW SetFilePointerEx WriteConsoleW LocalFree GetStdHandle SetStdHandle GetConsoleMode GetConsoleCP FlushFileBuffers GetCommandLineW RaiseException IsDebuggerPresent IsProcessorFeaturePresent EncodePointer GetLastError SetLastError GetCurrentThreadId DecodePointer ExitProcess GetModuleHandleExW GetProcAddress MultiByteToWideChar WideCharToMultiByte GetProcessHeap CreateFileW GetFileType DeleteCriticalSection GetModuleFileNameW WriteFile QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter Sleep GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW IsValidCodePage GetACP GetOEMCP GetCPInfo EnterCriticalSection LeaveCriticalSection HeapFree RtlUnwind OutputDebugStringW GetStringTypeW HeapAlloc HeapReAlloc HeapSize LCMapStringW

advapi32

RegEnumValueW RegQueryValueExW RegEnumKeyExW RegQueryInfoKeyW GetTraceLoggerHandle

wintrust

WinVerifyTrust CryptCATAdminReleaseCatalogContext WTHelperGetProvCertFromChain CryptCATAdminCalcHashFromFileHandle

Name

.text

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

355KB

Virtual Size

687KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1024B

Virtual Size

724B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.d3S8w

Size

284KB

Virtual Size

283KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ML6W7

Size

63KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

29KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.671873dfd6f3bd59805b8759aef85dfb

user32

kernel32

advapi32

wintrust

generic