jaffacakes118_not-a-virus[.]HEUR[.]AdWare[.]Win32[.]DownloadHelper[.]gen[.]81325392fb3af4adf2d41bfdcb618b14

General

Target
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.81325392fb3af4adf2d41bfdcb618b14
Size 927KB
Sample261014-evd67aytbt
SHA256 bccccb7ad670f5cd7cd4923e13605278bfa3d29187d647bd8e22842b3b4e724b
MD5 81325392fb3af4adf2d41bfdcb618b14
SHA1 c2ce463f21bcd263498a783e18aae1fc68db8f9b
SHA512 2badc44b7e4a238837a586dfd2ea1c4ba33530522093bcf909e7136a8115c8877bb24bb144ae8517184882fb0ea68c2f94716cb299c6b8817a106d596a3bf117
SSDEEP 12288:vvRkayX4fJaaYfcX4MjqZxdvXKWQSifisMcuJfO0qG52FK5iU0lDeVlbvNJgyI:H7PJci40wxdvXKX9McCfO/FKsUlVlxRI
TLSH
T1F81589416CF382E1C49B95B14B117EBE15272DF159B82E86624837CBD73F390A2787CA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.81325392fb3af4adf2d41bfdcb618b14

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.81325392fb3af4adf2d41bfdcb618b14

.exe 927KB

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.81325392fb3af4adf2d41bfdcb618b14

IMPHASH 6125127775c019b3579310e9114302ff
SHA256 bccccb7ad670f5cd7cd4923e13605278bfa3d29187d647bd8e22842b3b4e724b
MD5 81325392fb3af4adf2d41bfdcb618b14
SHA1 c2ce463f21bcd263498a783e18aae1fc68db8f9b
SHA512 2badc44b7e4a238837a586dfd2ea1c4ba33530522093bcf909e7136a8115c8877bb24bb144ae8517184882fb0ea68c2f94716cb299c6b8817a106d596a3bf117
SSDEEP 12288:vvRkayX4fJaaYfcX4MjqZxdvXKWQSifisMcuJfO0qG52FK5iU0lDeVlbvNJgyI:H7PJci40wxdvXKX9McCfO/FKsUlVlxRI
TLSH
T1F81589416CF382E1C49B95B14B117EBE15272DF159B82E86624837CBD73F390A2787CA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

29233

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetStartupInfoW OutputDebugStringW FindResourceW FindResourceExW GetFileAttributesW GetACP GetCPInfo CreateMutexW CompareStringW GetLocaleInfoW GetUserDefaultLCID WriteConsoleW SetFilePointerEx SetStdHandle GetConsoleMode GetSystemInfo GetSystemTimeAsFileTime CloseHandle GetFileType LoadResource DeleteCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection InitializeCriticalSection GetLastError GetCurrentThreadId FreeEnvironmentStringsW GetEnvironmentStringsW VirtualAlloc GlobalUnlock GlobalLock MultiByteToWideChar GetProcAddress GetCommandLineW SetLastError EncodePointer DecodePointer ExitProcess GetModuleHandleExW WideCharToMultiByte GetProcessHeap GetStdHandle GetModuleFileNameW WriteFile QueryPerformanceCounter GetCurrentProcessId UnhandledExceptionFilter SetUnhandledExceptionFilter Sleep GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW EnterCriticalSection HeapFree IsValidCodePage GetOEMCP IsDebuggerPresent IsProcessorFeaturePresent LoadLibraryExW RtlUnwind HeapAlloc HeapReAlloc GetStringTypeW HeapSize LCMapStringW FlushFileBuffers GetConsoleCP CreateFileW

wintrust

WTHelperProvDataFromStateData WinVerifyTrust CryptCATAdminCalcHashFromFileHandle

crypt32

CertGetCertificateChain CryptQueryObject CryptExportPublicKeyInfo CertFindExtension CertVerifyTimeValidity CertGetEnhancedKeyUsage CertControlStore CertAddStoreToCollection CertAddCertificateContextToStore CertAddEncodedCertificateToStore CertFreeCRLContext CertSetCertificateContextProperty CertFreeCertificateContext CryptMsgOpenToDecode CryptEnumOIDInfo CryptEncodeObject CryptBinaryToStringW

Name

.text

Size

64KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

345KB

Virtual Size

7.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1024B

Virtual Size

724B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.1tft0a

Size

114KB

Virtual Size

113KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.20o5u

Size

300KB

Virtual Size

302KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

99KB

Virtual Size

98KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.81325392fb3af4adf2d41bfdcb618b14

kernel32

wintrust

crypt32

generic