jaffacakes118_not-a-virus[.]HEUR[.]AdWare[.]Win32[.]DownloadHelper[.]gen[.]c10a28e45a3acad1ba72a15b320d6e95

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.c10a28e45a3acad1ba72a15b320d6e95
Size 2.2MB
Sample261014-ex772sf14k
SHA256 4e30c09b534233f105a5b03d1e20a3ed8fb033e87e99aec4ec16641ab721efa1
MD5 c10a28e45a3acad1ba72a15b320d6e95
SHA1 c3707cf2520f335a0fc1a71fc2e9c0ef2fc28d2d
SHA512 1af833f79c676af399da80aad95d7c6e09460f138d7d0bbe26f2c17da0d0a5c2d18b9645f284c1b8081ff2a977b2d8584c80d3508f935e5f6e83440ad759ce3f
SSDEEP 24576:XNSDPtIyDy/RSxdZh71e1NR578tTHN4WLHt:dSDV/ykXhePRW74E
TLSH
T1FEB5120531C2CA6EC0B647F4096BD276986A7E219A74148732D27F2F7AB01F36F25F52
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.c10a28e45a3acad1ba72a15b320d6e95

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.c10a28e45a3acad1ba72a15b320d6e95

.exe 2.2MB

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.c10a28e45a3acad1ba72a15b320d6e95

IMPHASH 99167ff47902f5b39ea4c24a89a77ccc
SHA256 4e30c09b534233f105a5b03d1e20a3ed8fb033e87e99aec4ec16641ab721efa1
MD5 c10a28e45a3acad1ba72a15b320d6e95
SHA1 c3707cf2520f335a0fc1a71fc2e9c0ef2fc28d2d
SHA512 1af833f79c676af399da80aad95d7c6e09460f138d7d0bbe26f2c17da0d0a5c2d18b9645f284c1b8081ff2a977b2d8584c80d3508f935e5f6e83440ad759ce3f
SSDEEP 24576:XNSDPtIyDy/RSxdZh71e1NR578tTHN4WLHt:dSDV/ykXhePRW74E
TLSH
T1FEB5120531C2CA6EC0B647F4096BD276986A7E219A74148732D27F2F7AB01F36F25F52
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

39550

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

urlmon

RegisterBindStatusCallback CreateURLMoniker

user32

DdeQueryConvInfo CopyIcon GetWindowLongW HideCaret GetWindowContextHelpId SetWindowTextW GetWindowRgn GetWindowDC DrawIcon AppendMenuW DrawMenuBar CopyAcceleratorTableW LoadAcceleratorsW ReleaseCapture SetCapture CloseClipboard SendDlgItemMessageW GetDlgItem GetWindowPlacement ShowWindowAsync CreateWindowExW UnregisterClassW DefWindowProcW ExitWindowsEx

psapi

GetDeviceDriverFileNameW

advapi32

RegCloseKey

kernel32

WriteConsoleW SetFilePointerEx SetStdHandle GetConsoleMode GetConsoleCP FlushFileBuffers LCMapStringW CloseHandle HeapSize HeapReAlloc HeapAlloc GetStringTypeW OutputDebugStringW RtlUnwind LoadLibraryExW HeapFree LeaveCriticalSection EnterCriticalSection GetCPInfo WideCharToMultiByte LocalAlloc LocalSize LocalFree VirtualAlloc WaitForSingleObject GetSystemInfo FileTimeToDosDateTime TlsFree GetModuleHandleW CreateProcessW GetProfileIntW GetFileAttributesW GetLocaleInfoW EnumCalendarInfoW GetConsoleWindow GetCommandLineW RaiseException IsProcessorFeaturePresent EncodePointer GetLastError SetLastError GetCurrentThreadId DecodePointer ExitProcess GetModuleHandleExW GetProcAddress MultiByteToWideChar GetOEMCP GetProcessHeap GetStdHandle GetFileType DeleteCriticalSection GetStartupInfoW GetModuleFileNameW WriteFile QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount Sleep GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue IsDebuggerPresent IsValidCodePage GetACP CreateFileW

winspool.drv

FindNextPrinterChangeNotification

Name

.text

Size

77KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

469KB

Virtual Size

6.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1024B

Virtual Size

724B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.e7372

Size

984KB

Virtual Size

984KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.5or8

Size

95KB

Virtual Size

95KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.t4or

Size

252KB

Virtual Size

252KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

362KB

Virtual Size

362KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.c10a28e45a3acad1ba72a15b320d6e95

urlmon

user32

psapi

advapi32

kernel32

winspool.drv

generic