jaffacakes118_not-a-virus[.]HEUR[.]AdWare[.]Win32[.]DownloadHelper[.]gen[.]95f096e28bf4a980912b8f18f4ec5e5f

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.95f096e28bf4a980912b8f18f4ec5e5f
Size 2.1MB
Sample261014-ewxd6af12m
SHA256 c4525733a9279d5e5375473ec2d8c0ddfc9f6de54d667f868f6948e61eb93000
MD5 95f096e28bf4a980912b8f18f4ec5e5f
SHA1 02f77dbf55fdfb793bdbd3cc59236c67b2a06520
SHA512 d7d38c4495170df2616401a72a8048c07f77b0f2a7c252893b896223406c5e9650cf4f878edd85c32c03c7d4afb0c5c39436c781609760b3ce623c264f464970
SSDEEP 24576:YBSdaVAkP5PTNTu2uSxWTbajS0pZ1Ipa7R1nmrwgBnjdjK1:YBSYVAcurSjSk4c1Uwg9dM
TLSH
T16DA512013686E262DA5B8BF108EAC015656E3C1DB970779732CBFF8D26701B3D919F62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.95f096e28bf4a980912b8f18f4ec5e5f

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.95f096e28bf4a980912b8f18f4ec5e5f

.exe 2.1MB

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.95f096e28bf4a980912b8f18f4ec5e5f

IMPHASH 432d4bbd11c9c389a345a461c5f25969
SHA256 c4525733a9279d5e5375473ec2d8c0ddfc9f6de54d667f868f6948e61eb93000
MD5 95f096e28bf4a980912b8f18f4ec5e5f
SHA1 02f77dbf55fdfb793bdbd3cc59236c67b2a06520
SHA512 d7d38c4495170df2616401a72a8048c07f77b0f2a7c252893b896223406c5e9650cf4f878edd85c32c03c7d4afb0c5c39436c781609760b3ce623c264f464970
SSDEEP 24576:YBSdaVAkP5PTNTu2uSxWTbajS0pZ1Ipa7R1nmrwgBnjdjK1:YBSYVAcurSjSk4c1Uwg9dM
TLSH
T16DA512013686E262DA5B8BF108EAC015656E3C1DB970779732CBFF8D26701B3D919F62
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

83310

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

user32

SetScrollPos DrawAnimatedRects GetClassInfoW EnumDisplayMonitors SystemParametersInfoW DrawIconEx DestroyIcon DestroyCursor GetClassNameW InflateRect SetRectEmpty InvertRect GetSysColor MapWindowPoints ClientToScreen GetScrollPos GetKeyboardLayoutList DrawIcon RemoveMenu InsertMenuW DestroyMenu MsgWaitForMultipleObjects SendInput GetFocus GetActiveWindow SetFocus CharLowerW CheckDlgButton IsZoomed DeferWindowPos IsWindow

winspool.drv

EnumPortsW ReadPrinter

kernel32

LoadLibraryExW HeapFree LeaveCriticalSection EnterCriticalSection GetCPInfo GetOEMCP IsValidCodePage IsDebuggerPresent GetModuleHandleW TlsFree TlsSetValue RtlUnwind LocalFree VirtualAlloc HeapSize InitializeCriticalSection PulseEvent GetFileSize SetCommMask FileTimeToDosDateTime ExpandEnvironmentStringsW OutputDebugStringW FindResourceW GetTempPathW SetDefaultCommConfigW GetACP GetLocaleInfoW GetConsoleWindow GetStringTypeW HeapAlloc HeapReAlloc LCMapStringW FlushFileBuffers GetConsoleCP GetConsoleMode SetStdHandle SetFilePointerEx WriteConsoleW CloseHandle GlobalLock CreateFileW TlsAlloc TerminateProcess GetCurrentProcess Sleep TlsGetValue InitializeCriticalSectionAndSpinCount SetUnhandledExceptionFilter UnhandledExceptionFilter FreeEnvironmentStringsW GetEnvironmentStringsW GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter WriteFile GetModuleFileNameW GetStartupInfoW DeleteCriticalSection GetFileType GetStdHandle GetProcessHeap WideCharToMultiByte MultiByteToWideChar GetProcAddress GetModuleHandleExW ExitProcess DecodePointer GetCurrentThreadId SetLastError GetLastError EncodePointer IsProcessorFeaturePresent RaiseException GetCommandLineW

advapi32

OpenSCManagerW

comctl32

CreateStatusWindowW ImageList_GetImageInfo ImageList_Read ImageList_DragShowNolock ImageList_DragLeave ImageList_EndDrag FlatSB_GetScrollInfo ImageList_DrawIndirect ImageList_Draw ImageList_SetBkColor ImageList_ReplaceIcon ImageList_SetImageCount DestroyPropertySheetPage CreatePropertySheetPageW ImageList_GetIcon FlatSB_SetScrollPos

setupapi

SetupDiCreateDeviceInfoListExW SetupGetLineCountW SetupOpenFileQueue SetupDiCreateDeviceInfoList SetupDiOpenDeviceInfoW SetupDiGetDeviceInstanceIdW SetupDiGetDeviceInterfaceDetailW SetupDiBuildDriverInfoList SetupDiGetSelectedDriverW SetupDiGetClassDevsExW SetupDiCallClassInstaller SetupDiOpenDevRegKey SetupDiGetDeviceRegistryPropertyW SetupDiSetDeviceInstallParamsW SetupDiGetActualSectionToInstallW CM_Get_Device_IDW CM_Get_DevNode_Status CM_Get_Parent CM_Get_Parent_Ex SetupFindFirstLineW

shlwapi

StrRChrW StrStrIW StrChrIW StrToIntW StrCmpIW StrRetToStrW SHStrDupW PathFindNextComponentW PathIsRelativeW PathIsRootW PathIsUNCW PathIsURLW PathRemoveBackslashW PathRemoveExtensionW SHCreateStreamOnFileEx SHCreateStreamOnFileW SHSetValueW SHGetValueW SHDeleteValueW PathCreateFromUrlW UrlEscapeW StrCmpNW PathStripToRootW

Name

.text

Size

119KB

Virtual Size

119KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

623KB

Virtual Size

7.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1024B

Virtual Size

724B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.2o9i

Size

657KB

Virtual Size

657KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.l9ty

Size

317KB

Virtual Size

316KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.at8ns

Size

46KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

362KB

Virtual Size

362KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.95f096e28bf4a980912b8f18f4ec5e5f

user32

winspool.drv

kernel32

advapi32

comctl32

setupapi

shlwapi

generic