jaffacakes118_not-a-virus[.]HEUR[.]AdWare[.]Win32[.]DownloadHelper[.]gen[.]b4f7a65575d9669677772dd318a8f4d2

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.b4f7a65575d9669677772dd318a8f4d2
Size 1.8MB
Sample261014-exnteaed87
SHA256 1fbe6674968ce076ebb9b7cb98cd6d212f1ec5b601d75f0ecfbec5cdd130970e
MD5 b4f7a65575d9669677772dd318a8f4d2
SHA1 407f771c08d44766b5b4b0112cce5c90c5fc76f4
SHA512 91e88aabbfa5bfeceb391a6b467d01b1184ef176e0bc606b7a384cc0f9f0d0822c9248c85f9d4a0a424207bdb149c9d0d50c0cc2f4f5893ed861ceec4b775244
SSDEEP 24576:4bRxVrJXTbqDCPybXMVoZxy83URLwesa2xkzSb:4bRPVXTOuPybXMCZ68zb
TLSH
T1BC951204B192D03DD8F7C6F59AA5C6568C653C256A6048D733C0BFDE6B37383AE14EA2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.b4f7a65575d9669677772dd318a8f4d2

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.b4f7a65575d9669677772dd318a8f4d2

.exe 1.8MB

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.b4f7a65575d9669677772dd318a8f4d2

IMPHASH 4ff0b1db650736cab2320bf0c55a62f2
SHA256 1fbe6674968ce076ebb9b7cb98cd6d212f1ec5b601d75f0ecfbec5cdd130970e
MD5 b4f7a65575d9669677772dd318a8f4d2
SHA1 407f771c08d44766b5b4b0112cce5c90c5fc76f4
SHA512 91e88aabbfa5bfeceb391a6b467d01b1184ef176e0bc606b7a384cc0f9f0d0822c9248c85f9d4a0a424207bdb149c9d0d50c0cc2f4f5893ed861ceec4b775244
SSDEEP 24576:4bRxVrJXTbqDCPybXMVoZxy83URLwesa2xkzSb:4bRPVXTOuPybXMCZ68zb
TLSH
T1BC951204B192D03DD8F7C6F59AA5C6568C653C256A6048D733C0BFDE6B37383AE14EA2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

74222

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExW RegDeleteValueW RegQueryValueExW RegCloseKey

kernel32

HeapReAlloc GetLastError InitializeCriticalSection LeaveCriticalSection DeleteCriticalSection SetHandleCount GetFileType SetFileValidData GetCommProperties HeapDestroy MulDiv FileTimeToLocalFileTime FlushViewOfFile CreateMutexW GetModuleHandleW GetProcessVersion ExpandEnvironmentStringsW GetProfileIntW GetFileAttributesW DeleteFileW MultiByteToWideChar GetConsoleWindow VirtualAlloc GlobalLock GlobalAlloc GetVersion SetCommConfig CloseHandle WriteConsoleW SetFilePointerEx SetStdHandle GetConsoleMode GetConsoleCP FlushFileBuffers LCMapStringW HeapSize HeapAlloc GetStringTypeW OutputDebugStringW RtlUnwind LoadLibraryExW HeapFree EnterCriticalSection GetCPInfo GetOEMCP GetACP IsValidCodePage IsDebuggerPresent TlsFree TlsSetValue TlsGetValue TlsAlloc CreateFileW TerminateProcess GetCurrentProcess Sleep InitializeCriticalSectionAndSpinCount SetUnhandledExceptionFilter UnhandledExceptionFilter GetCommandLineW RaiseException IsProcessorFeaturePresent EncodePointer SetLastError GetCurrentThreadId DecodePointer ExitProcess GetModuleHandleExW GetProcAddress WideCharToMultiByte GetProcessHeap GetStdHandle GetStartupInfoW GetModuleFileNameW WriteFile QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW

comdlg32

PrintDlgW ReplaceTextW FindTextW GetSaveFileNameW

mpr

WNetGetConnectionW WNetOpenEnumW WNetGetLastErrorW

opengl32

glCopyTexSubImage2D glBindTexture glDepthMask glDisable glFlush glGenTextures glGetError glGetString glIsEnabled glPixelStorei glReadPixels glStencilFunc glStencilOp glTexImage2D glTexSubImage2D glDepthFunc

user32

DestroyWindow DdeSetUserHandle MoveWindow IsZoomed DialogBoxParamW GetInputState SetCapture GetSystemMenu GetPropW FillRect CopyRect LoadIconW CreateIcon DestroyIcon TranslateMDISysAccel IsIconic IsChild

wininet

InternetQueryOptionW InternetSetOptionW HttpOpenRequestW HttpAddRequestHeadersW InternetOpenUrlW

Name

.text

Size

111KB

Virtual Size

110KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

450KB

Virtual Size

7.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1024B

Virtual Size

724B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bhewu

Size

181KB

Virtual Size

181KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.oi05

Size

435KB

Virtual Size

435KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.t3pg7t

Size

563KB

Virtual Size

562KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

100KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.b4f7a65575d9669677772dd318a8f4d2

advapi32

kernel32

comdlg32

mpr

opengl32

user32

wininet

generic