jaffacakes118_not-a-virus[.]HEUR[.]AdWare[.]Win32[.]DownloadHelper[.]gen[.]c3e43d83cdd2318097793cebec3d67e2

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.c3e43d83cdd2318097793cebec3d67e2
Size 2.0MB
Sample261014-eyebcsfv8y
SHA256 c65a178bcf99c33b8be8f36c4e5e598034ba558c47cd2b30920bb04b9f112d54
MD5 c3e43d83cdd2318097793cebec3d67e2
SHA1 724be6242132c04fb90fabeea013b4e2391cb818
SHA512 6855148afdf327025f08dc9f24f2022c9bbc85d4fd91d318db972c11363749d4f7a41edfc02e7c7a09690944584370f97c3b8cb5d1de311ac0e5b2f3e4a421a5
SSDEEP 24576:8e7gHBgf3V9Ld+b2S7krbFdCLdcI3oRr/yr8fZEpXmlqKp3id9Fnm:8eFPPLAbsrJdC/IFGprQ
TLSH
T1E8A50141A242E162E1AF45F60B27B339556AFC65BAE15893F7C0FF1E18311D3A620F63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.c3e43d83cdd2318097793cebec3d67e2

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.c3e43d83cdd2318097793cebec3d67e2

.exe 2.0MB

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.c3e43d83cdd2318097793cebec3d67e2

IMPHASH 485ff46fa915853b73808cd6944651b6
SHA256 c65a178bcf99c33b8be8f36c4e5e598034ba558c47cd2b30920bb04b9f112d54
MD5 c3e43d83cdd2318097793cebec3d67e2
SHA1 724be6242132c04fb90fabeea013b4e2391cb818
SHA512 6855148afdf327025f08dc9f24f2022c9bbc85d4fd91d318db972c11363749d4f7a41edfc02e7c7a09690944584370f97c3b8cb5d1de311ac0e5b2f3e4a421a5
SSDEEP 24576:8e7gHBgf3V9Ld+b2S7krbFdCLdcI3oRr/yr8fZEpXmlqKp3id9Fnm:8eFPPLAbsrJdC/IFGprQ
TLSH
T1E8A50141A242E162E1AF45F60B27B339556AFC65BAE15893F7C0FF1E18311D3A620F63
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

57262

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

user32

DdeConnectList RegisterRawInputDevices GetMonitorInfoW DrawIconEx DestroyCursor GetWindow FindWindowExW SetParent IntersectRect CopyRect SetCursorPos ScrollDC SetWindowRgn EndPaint ReleaseDC GetDC SetMenuItemInfoW GetMenuItemInfoW TrackPopupMenu DrawMenuBar CharPrevW GetNextDlgTabItem GetDlgItem DialogBoxParamW ShowOwnedPopups DestroyWindow BroadcastSystemMessageW TranslateMessage

rasapi32

RasGetEntryPropertiesW

kernel32

DecodePointer CreateFileW WriteConsoleW SetFilePointerEx SetStdHandle GetConsoleMode GetConsoleCP FlushFileBuffers LCMapStringW HeapSize HeapReAlloc OutputDebugStringW RtlUnwind LoadLibraryExW HeapFree LeaveCriticalSection GetOEMCP GetACP IsValidCodePage IsDebuggerPresent GetModuleHandleW VirtualAlloc HeapAlloc EnterCriticalSection ReadFile CloseHandle GetSystemTimeAsFileTime FileTimeToSystemTime GetModuleFileNameW CreateProcessW ExpandEnvironmentStringsW GetSystemDirectoryW CreateDirectoryW GetFileAttributesW FindFirstFileW FindNextFileW GetCPInfo MultiByteToWideChar GetLocaleInfoW GetUserDefaultLCID GetStringTypeExW GetStringTypeW GetCommandLineW RaiseException IsProcessorFeaturePresent EncodePointer GetLastError SetLastError GetCurrentThreadId TlsFree ExitProcess GetModuleHandleExW GetProcAddress WideCharToMultiByte GetProcessHeap GetStdHandle GetFileType DeleteCriticalSection GetStartupInfoW WriteFile QueryPerformanceCounter GetCurrentProcessId GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount Sleep GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue

wintrust

CryptCATAdminCalcHashFromFileHandle CryptCATAdminAcquireContext

Name

.text

Size

94KB

Virtual Size

94KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

638KB

Virtual Size

7.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1024B

Virtual Size

724B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.r1n77n

Size

715KB

Virtual Size

715KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.di2e8h

Size

141KB

Virtual Size

141KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.t0tn4

Size

110KB

Virtual Size

110KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

363KB

Virtual Size

362KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.c3e43d83cdd2318097793cebec3d67e2

user32

rasapi32

kernel32

wintrust

generic