jaffacakes118_not-a-virus[.]HEUR[.]AdWare[.]Win32[.]DownloadHelper[.]gen[.]aacfe43e5e58ee87d7932f393971e62c

General

Target
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.aacfe43e5e58ee87d7932f393971e62c
Size 1.1MB
Sample261014-exdnfafv7t
SHA256 eeda7bf63b637351970c884ae5e1c1d1a4bbc201c0cd46089febac1868336dec
MD5 aacfe43e5e58ee87d7932f393971e62c
SHA1 56311d55d79fff159ec1245a087b9c1f3e05796f
SHA512 e077deba2e76c71fe836821733a028b8fbb32f7c93d16e0d76e89f043b7ae7f3c0ea6020e315af432507334eb82486675dccbbda2c854a36e26cab6dcbacb2ff
SSDEEP 24576:BWt3hXmT+1ba0sp1wWIN1s5euDx08+SP0L:smiY0idveax08+SP0L
TLSH
T1AD3523B2B6D1A27CD0764D3349E8054154FDFA275C704E4FB38C1E2DB9A52C3E62EA26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.aacfe43e5e58ee87d7932f393971e62c

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.aacfe43e5e58ee87d7932f393971e62c

.exe 1.1MB

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.aacfe43e5e58ee87d7932f393971e62c

IMPHASH 0451db6c13650e5840f3c31d27de570d
SHA256 eeda7bf63b637351970c884ae5e1c1d1a4bbc201c0cd46089febac1868336dec
MD5 aacfe43e5e58ee87d7932f393971e62c
SHA1 56311d55d79fff159ec1245a087b9c1f3e05796f
SHA512 e077deba2e76c71fe836821733a028b8fbb32f7c93d16e0d76e89f043b7ae7f3c0ea6020e315af432507334eb82486675dccbbda2c854a36e26cab6dcbacb2ff
SSDEEP 24576:BWt3hXmT+1ba0sp1wWIN1s5euDx08+SP0L:smiY0idveax08+SP0L
TLSH
T1AD3523B2B6D1A27CD0764D3349E8054154FDFA275C704E4FB38C1E2DB9A52C3E62EA26
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

10

Major OS version

5

Entry point

18685

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LCMapStringW GetSystemDirectoryW FindResourceW OutputDebugStringW GetModuleHandleW lstrcmpiW FileTimeToSystemTime GetLocalTime WriteFile SetHandleCount WaitForSingleObject InitializeCriticalSectionAndSpinCount EnterCriticalSection GetLastError GetCurrentThreadId GetEnvironmentStringsW ExitProcess HeapFree HeapDestroy VirtualAlloc GlobalFree GlobalAlloc CloseHandle WriteConsoleW SetFilePointerEx SetStdHandle GetConsoleMode GetCommandLineA SetLastError EncodePointer DecodePointer GetModuleHandleExW GetProcAddress MultiByteToWideChar WideCharToMultiByte GetProcessHeap GetStdHandle GetFileType DeleteCriticalSection GetStartupInfoW GetModuleFileNameA GetModuleFileNameW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter Sleep GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree LeaveCriticalSection IsValidCodePage GetACP GetOEMCP GetCPInfo IsDebuggerPresent IsProcessorFeaturePresent LoadLibraryExW RtlUnwind HeapAlloc HeapReAlloc GetStringTypeW HeapSize FlushFileBuffers GetConsoleCP CreateFileW

advapi32

RegOpenKeyExW RegQueryValueExW RegDeleteKeyW RegCloseKey RegSetValueExW

crypt32

CertNameToStrW CryptAcquireCertificatePrivateKey CertFindExtension CertVerifyTimeValidity CertAddCertificateContextToStore CertAddEncodedCertificateToStore CertFreeCRLContext CertGetCertificateContextProperty CertGetNameStringW CertCloseStore CryptMsgClose CryptEnumOIDInfo CryptFindOIDInfo CryptDecodeObject CryptEncodeObject CryptEncodeObjectEx CertFreeCertificateChain CertVerifyCertificateChainPolicy CryptStringToBinaryW CryptBinaryToStringW CertEnumCertificatesInStore

uxtheme

IsThemeBackgroundPartiallyTransparent GetThemePartSize CloseThemeData GetWindowTheme

Sharing