jaffacakes118_not-a-virus[.]HEUR[.]AdWare[.]Win32[.]DownloadHelper[.]gen[.]3c34f316ae659be601887de3fc681ce5

General

Target
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.3c34f316ae659be601887de3fc681ce5
Size 2.5MB
Sample261014-esd4eavz3m
SHA256 ed8994b0a0121d7480c5d4225656dba58bcfd40ec308f6dbb66d9830d2499a15
MD5 3c34f316ae659be601887de3fc681ce5
SHA1 c084364f9fa00c2683ecfeea6724bd48e62e2e06
SHA512 8aa5d7100214bc83e315e4cdd2c48a255acb31104fe8d29271af5d5ec058da9fc050746c7cebb4ccf4bb4fb906dc1e740919a8091a1a2967eea7c88d9a3f1931
SSDEEP 24576:rtvSPNEJFf6m6nVqQgWJebVGP6P0sD9P7zjSuXaAEwsz8SQ7u/f:svLx8Z3b9zOuZ0zVn
TLSH
T139C5330CD09555F4D4C72577AAB166A7C03C7B098D3A3187A6AD6C0F88BF187B906E3B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.3c34f316ae659be601887de3fc681ce5

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.3c34f316ae659be601887de3fc681ce5

.exe 2.5MB

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.3c34f316ae659be601887de3fc681ce5

IMPHASH 8edf827721293f992495661a2456fa43
SHA256 ed8994b0a0121d7480c5d4225656dba58bcfd40ec308f6dbb66d9830d2499a15
MD5 3c34f316ae659be601887de3fc681ce5
SHA1 c084364f9fa00c2683ecfeea6724bd48e62e2e06
SHA512 8aa5d7100214bc83e315e4cdd2c48a255acb31104fe8d29271af5d5ec058da9fc050746c7cebb4ccf4bb4fb906dc1e740919a8091a1a2967eea7c88d9a3f1931
SSDEEP 24576:rtvSPNEJFf6m6nVqQgWJebVGP6P0sD9P7zjSuXaAEwsz8SQ7u/f:svLx8Z3b9zOuZ0zVn
TLSH
T139C5330CD09555F4D4C72577AAB166A7C03C7B098D3A3187A6AD6C0F88BF187B906E3B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

10

Major OS version

5

Entry point

1133512

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ole32

CoTaskMemFree CoTaskMemRealloc CLSIDFromProgID StringFromCLSID

kernel32

TlsGetValue GetProcAddress GlobalLock GlobalUnlock VirtualAlloc HeapAlloc HeapReAlloc GetCurrentProcessId GetEnvironmentStringsW GetCurrentThreadId GetLastError EnterCriticalSection LoadResource CloseHandle GetLocalTime FormatMessageW lstrcmpW CreateEventW GetModuleHandleW GetCommandLineW ExpandEnvironmentStringsW OutputDebugStringW FindResourceW CreateDirectoryW FindNextFileW GetACP LCMapStringW GetStringTypeW GetModuleHandleA GetStartupInfoA GetCommandLineA GetVersion ExitProcess TerminateProcess GetCurrentProcess UnhandledExceptionFilter GetModuleFileNameA FreeEnvironmentStringsA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStrings SetHandleCount GetStdHandle GetFileType TlsSetValue TlsAlloc SetLastError GetEnvironmentVariableA GetVersionExA HeapDestroy HeapCreate VirtualFree HeapFree RtlUnwind WriteFile InitializeCriticalSection LeaveCriticalSection GetCPInfo GetOEMCP LoadLibraryA MultiByteToWideChar LCMapStringA GetStringTypeA InterlockedDecrement InterlockedIncrement

shlwapi

PathCreateFromUrlW SHGetValueW SHSetValueW UrlUnescapeW StrCmpNIW StrToIntW StrRetToBufW SHStrDupW PathAppendW PathFileExistsW PathFindNextComponentW PathGetDriveNumberW PathIsDirectoryW PathIsRelativeW PathIsRootW PathIsNetworkPathW PathIsUNCServerW PathIsURLW UrlIsW

Sharing