jaffacakes118_not-a-virus[.]HEUR[.]AdWare[.]Win32[.]DownloadHelper[.]gen[.]b8cc7370086b180953886f0330ea94c0

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.b8cc7370086b180953886f0330ea94c0
Size 2.2MB
Sample261014-exxfjsf13m
SHA256 988c38f024e83d2499c6d05f2f3e6f6aba84556ff87804589e0a5a1458d157e3
MD5 b8cc7370086b180953886f0330ea94c0
SHA1 192e01851c4c51da590890f2d49ae2b91b9901b6
SHA512 61f4a38e1c8560483b4b4115941b6f92809e9f3db01698d56e6ea2459f6126a7b717beb122f6cbaf1fccded19fa4db14c23e4a21cf0667a0af02348e60563f57
SSDEEP 24576:WuSt2g/rtevZSGpgOGbBdm9VfZZwq0PJUmhm1a:WJHCZSGu1kQim1
TLSH
T1CAA52301B082C576C5BFD6F506A9466D59BC7C5A32B08D873AD60E9E0C703C3DE29EA7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.b8cc7370086b180953886f0330ea94c0

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.b8cc7370086b180953886f0330ea94c0

.exe 2.2MB

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.b8cc7370086b180953886f0330ea94c0

IMPHASH ef60fac854723dee004ab5f3452c901c
SHA256 988c38f024e83d2499c6d05f2f3e6f6aba84556ff87804589e0a5a1458d157e3
MD5 b8cc7370086b180953886f0330ea94c0
SHA1 192e01851c4c51da590890f2d49ae2b91b9901b6
SHA512 61f4a38e1c8560483b4b4115941b6f92809e9f3db01698d56e6ea2459f6126a7b717beb122f6cbaf1fccded19fa4db14c23e4a21cf0667a0af02348e60563f57
SSDEEP 24576:WuSt2g/rtevZSGpgOGbBdm9VfZZwq0PJUmhm1a:WJHCZSGu1kQim1
TLSH
T1CAA52301B082C576C5BFD6F506A9466D59BC7C5A32B08D873AD60E9E0C703C3DE29EA7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

32142

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

user32

DispatchMessageW TranslateMessage DdeQueryConvInfo GetIconInfo LoadImageW LoadIconW LoadCursorW CopyRect GetSysColorBrush EnumPropsW DrawIcon GetMenuItemInfoW RemoveMenu AppendMenuW LoadAcceleratorsW SetCapture CharPrevW CharLowerW GetDlgItemTextW RegisterClassExW InSendMessageEx DefWindowProcW

kernel32

CreateFileW CloseHandle WriteConsoleW SetFilePointerEx SetStdHandle GetConsoleMode GetConsoleCP FlushFileBuffers LCMapStringW HeapSize HeapReAlloc HeapAlloc GetStringTypeW RtlUnwind LoadLibraryExW VirtualAlloc EnterCriticalSection DeleteCriticalSection SetEndOfFile UnmapViewOfFile lstrcmpW GetModuleHandleW OutputDebugStringW GetTempPathW GetFullPathNameW GetACP CompareStringW GetStringTypeExW HeapFree LeaveCriticalSection GetCPInfo GetOEMCP IsValidCodePage IsDebuggerPresent TlsFree TlsSetValue TlsGetValue TlsAlloc TerminateProcess GetCurrentProcess Sleep InitializeCriticalSectionAndSpinCount SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcessId QueryPerformanceCounter FreeEnvironmentStringsW GetEnvironmentStringsW WriteFile GetModuleFileNameW GetSystemTimeAsFileTime GetStartupInfoW GetFileType GetStdHandle GetProcessHeap WideCharToMultiByte MultiByteToWideChar GetProcAddress GetModuleHandleExW ExitProcess DecodePointer GetCurrentThreadId SetLastError GetLastError EncodePointer IsProcessorFeaturePresent RaiseException GetCommandLineW

shlwapi

PathIsNetworkPathW StrCmpNIW SHCreateStreamOnFileW AssocCreate SHDeleteValueW SHDeleteKeyW PathSkipRootW PathRemoveFileSpecW PathRemoveBlanksW PathIsURLW StrChrIW PathIsUNCW PathFindNextComponentW PathFindFileNameW PathCanonicalizeW PathAddBackslashW SHStrDupW StrRChrW StrDupW

ntdsapi

DsFreeNameResultW

winspool.drv

CloseSpoolFileHandle

oleaut32

GetErrorInfo SetErrorInfo SysReAllocStringLen SysStringLen SafeArrayRedim SafeArrayGetUBound SafeArrayAccessData SafeArrayUnaccessData SafeArrayPutElement VariantClear VariantCopy VariantCopyInd VariantChangeType VariantChangeTypeEx VarI4FromStr VarR8FromStr VarDateFromStr RegisterTypeLi VarNot VarNeg VarBstrFromDate VarBstrFromCy VarCyFromStr SafeArrayCreate

setupapi

CM_Locate_DevNodeW CM_Get_DevNode_Registry_Property_ExW CM_Get_Device_ID_ExW CM_Get_Device_IDW SetupDiGetActualSectionToInstallW SetupDiSetDeviceInstallParamsW SetupDiSetDeviceRegistryPropertyW SetupDiGetDeviceRegistryPropertyW SetupDiGetClassDevsW SetupDiGetSelectedDriverW SetupDiEnumDriverInfoW SetupDiGetDeviceInterfaceDetailW SetupDiGetDeviceInstanceIdW SetupDiCreateDeviceInfoListExW SetupCloseFileQueue SetupGetIntField