jaffacakes118_not-a-virus[.]HEUR[.]AdWare[.]Win32[.]DownloadHelper[.]gen[.]4e7d75c4ae591135797e76f2f655a5a8

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.4e7d75c4ae591135797e76f2f655a5a8
Size 1.6MB
Sample261014-esttvsfv3z
SHA256 755f6957ee971fc51c953ebcb27716be9b9a2be3b0a4b2d0ff58173db806f8ee
MD5 4e7d75c4ae591135797e76f2f655a5a8
SHA1 b9ba395a40200dda4f2ca6a9ab944a480e28ffa3
SHA512 6fd0051a2aa12579abb263c632c288cdaa629683e5379a8d9ebf8a7fbc730e896943d8f9c03181aba93f7af07b858b3fbaa1732746db386aad47f87270818a71
SSDEEP 24576:iR2j5LdIvUbD6hRspgFqmqy05fLqr0bqB:iRabDEGO2hY0bqB
TLSH
T18575234B62C5CCBAF4637AF884618803A6B9FD9957A1998733D41B491D342C39F34FA3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.4e7d75c4ae591135797e76f2f655a5a8

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.4e7d75c4ae591135797e76f2f655a5a8

.exe 1.6MB

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.4e7d75c4ae591135797e76f2f655a5a8

IMPHASH 7849db47d1b075421a75dfe45d2ae3f1
SHA256 755f6957ee971fc51c953ebcb27716be9b9a2be3b0a4b2d0ff58173db806f8ee
MD5 4e7d75c4ae591135797e76f2f655a5a8
SHA1 b9ba395a40200dda4f2ca6a9ab944a480e28ffa3
SHA512 6fd0051a2aa12579abb263c632c288cdaa629683e5379a8d9ebf8a7fbc730e896943d8f9c03181aba93f7af07b858b3fbaa1732746db386aad47f87270818a71
SSDEEP 24576:iR2j5LdIvUbD6hRspgFqmqy05fLqr0bqB:iRabDEGO2hY0bqB
TLSH
T18575234B62C5CCBAF4637AF884618803A6B9FD9957A1998733D41B491D342C39F34FA3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

34454

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

winscard

SCardFreeMemory

user32

EnumDisplayMonitors SetScrollInfo MapDialogRect IsDialogMessageW EqualRect IsRectEmpty InflateRect ScreenToClient GetWindowRect EnableScrollBar GetScrollPos RedrawWindow EndPaint GetMenuState IsWindowUnicode SetTimer ReleaseCapture GetPriorityClipboardFormat GetDialogBaseUnits GetDlgCtrlID GetNextDlgTabItem GetDlgItemInt DeferWindowPos SetWindowPos IsChild ReplyMessage

kernel32

GetCPInfo GetOEMCP IsDebuggerPresent VirtualAlloc HeapAlloc HeapReAlloc ExitProcess EnterCriticalSection lstrcmpW LeaveCriticalSection GetCommandLineW GetFileAttributesExW FindFirstFileW CreateJobObjectW IsValidCodePage GetACP GetConsoleWindow HeapFree LoadLibraryExW RtlUnwind OutputDebugStringW GetStringTypeW HeapSize CreateFileW LCMapStringW FlushFileBuffers GetConsoleCP GetConsoleMode SetStdHandle SetFilePointerEx WriteConsoleW CloseHandle GetModuleHandleW TlsFree RaiseException EncodePointer GetLastError SetLastError GetCurrentThreadId DecodePointer GetModuleHandleExW GetProcAddress MultiByteToWideChar WideCharToMultiByte GetProcessHeap GetStdHandle GetFileType DeleteCriticalSection GetStartupInfoW GetModuleFileNameW WriteFile QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount Sleep GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue IsProcessorFeaturePresent

advapi32

RegDeleteValueW OpenSCManagerW RegOpenKeyExW

crypt32

CryptProtectData CertGetNameStringW CertNameToStrW CryptExportPKCS8 CryptAcquireCertificatePrivateKey CertFindExtension CertControlStore CertAddStoreToCollection CertVerifyCertificateChainPolicy CertAddEncodedCertificateToStore CertSetCertificateContextProperty CertEnumCertificatesInStore CertOpenStore CryptMsgGetParam CryptMsgUpdate CryptMsgClose CryptDecodeObject CryptStringToBinaryW CryptBinaryToStringW CertAddCertificateContextToStore CertFreeCRLContext

secur32

GetUserNameExW TranslateNameW