jaffacakes118_not-a-virus[.]HEUR[.]AdWare[.]Win32[.]DownloadHelper[.]gen[.]847a096895597abc6700dd8b99a18a69

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.847a096895597abc6700dd8b99a18a69
Size 1.6MB
Sample261014-evmtbsfz8n
SHA256 71a488c325d8984abe9b1bf681906876c8e17e2a5ee21e728035b64c04ec2d28
MD5 847a096895597abc6700dd8b99a18a69
SHA1 029db7730bb55ebfd2d122ee57207030ea73eb05
SHA512 411ee6e66100037e426546ff3220cca27f72693281ad9ba11f6b55fd8648f6d55d69cc7e607a4c9b6526e25a2b0a707b9936a5da5815e50911e0476983ef58f4
SSDEEP 24576:jgoYn+JmT/m5lZROFfY5HiWA/QhdJxO6BcjOSa5huH/EdWWm:jgotB7ZRAmIQ9gOiMdVm
TLSH
T17875231632C3D031D48B56F6A06494B65B3A7C759BB44A4B37D43F0E9BB10C2A636FA3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.847a096895597abc6700dd8b99a18a69

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.847a096895597abc6700dd8b99a18a69

.exe 1.6MB

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.847a096895597abc6700dd8b99a18a69

IMPHASH 65a9bc949b06d3793a25a953992a2c62
SHA256 71a488c325d8984abe9b1bf681906876c8e17e2a5ee21e728035b64c04ec2d28
MD5 847a096895597abc6700dd8b99a18a69
SHA1 029db7730bb55ebfd2d122ee57207030ea73eb05
SHA512 411ee6e66100037e426546ff3220cca27f72693281ad9ba11f6b55fd8648f6d55d69cc7e607a4c9b6526e25a2b0a707b9936a5da5815e50911e0476983ef58f4
SSDEEP 24576:jgoYn+JmT/m5lZROFfY5HiWA/QhdJxO6BcjOSa5huH/EdWWm:jgotB7ZRAmIQ9gOiMdVm
TLSH
T17875231632C3D031D48B56F6A06494B65B3A7C759BB44A4B37D43F0E9BB10C2A636FA3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

27732

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetProcessId EnterCriticalSection LeaveCriticalSection GetFileType PurgeComm GetSystemTimeAsFileTime MapViewOfFile CreateMutexW GetModuleHandleW GetProcessVersion FindResourceExW GetFullPathNameW DeleteFileW GetOEMCP MultiByteToWideChar GetConsoleWindow FreeEnvironmentStringsW CloseHandle WriteConsoleW SetFilePointerEx SetStdHandle GetConsoleMode GetConsoleCP FlushFileBuffers LCMapStringW HeapReAlloc HeapAlloc ExitProcess HeapSize VirtualAlloc GetStringTypeW OutputDebugStringW RtlUnwind LoadLibraryExW HeapFree GetCPInfo GetACP IsValidCodePage IsDebuggerPresent IsProcessorFeaturePresent TlsFree TlsSetValue TlsGetValue TlsAlloc TerminateProcess GetCurrentProcess Sleep InitializeCriticalSectionAndSpinCount CreateFileW SetUnhandledExceptionFilter GetCommandLineW RaiseException EncodePointer GetLastError SetLastError GetCurrentThreadId DecodePointer GetModuleHandleExW GetProcAddress WideCharToMultiByte GetProcessHeap GetStdHandle DeleteCriticalSection GetStartupInfoW GetModuleFileNameW WriteFile QueryPerformanceCounter GetCurrentProcessId GetEnvironmentStringsW UnhandledExceptionFilter

mpr

WNetGetLastErrorW

oleaut32

SysAllocStringLen SysReAllocStringLen SysFreeString SafeArrayCreate SafeArrayRedim SafeArrayGetElement VariantChangeType VarR8FromStr VarCyFromStr VarBstrFromCy VarBstrFromDate LoadTypeLi SetErrorInfo GetErrorInfo

advapi32

RegEnumValueW RegDeleteKeyW RegQueryInfoKeyW

psapi

GetModuleBaseNameW GetModuleFileNameExW GetProcessImageFileNameW GetDeviceDriverBaseNameW GetMappedFileNameW

user32

CallWindowProcW IsMenu BringWindowToTop IsDlgButtonChecked GetKeyboardType SendInput SetTimer GetScrollRange GetWindowTextW GetCursor DestroyCaret ScreenToClient WindowFromPoint PtInRect LoadIconW LoadStringW GetCursorInfo DdeConnect DdeCreateDataHandle