jaffacakes118_not-a-virus[.]HEUR[.]AdWare[.]Win32[.]DownloadHelper[.]gen[.]c837a47acf8a7ccbae6199776e8d7a7c

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.c837a47acf8a7ccbae6199776e8d7a7c
Size 2.3MB
Sample261014-eyrlpafv9t
SHA256 d0477dfa1db389fe571569662f1f7e88e43ee7eefe97a35e1dbf221d63acb532
MD5 c837a47acf8a7ccbae6199776e8d7a7c
SHA1 019a272d527e9cec0d92399d67b71fdfc227202c
SHA512 994f49d9dd1f3928da0356ec9c69df548a56d95e81df9dd686b5dc4e42781fbd0d6bcf482fd6ff93f22300bc259c40a79ac170c9519d9d848a74baf58bd9195d
SSDEEP 24576:eo/Pvvkx9xsINzJdIHj63ZNV0POmdMPFCBAk2v8:eokpdbpIT4M
TLSH
T13BB5CF33EEED8DBDE85E0EB7E02D856444FFED20659060A2FD83FE2963352425634925
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.c837a47acf8a7ccbae6199776e8d7a7c

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.c837a47acf8a7ccbae6199776e8d7a7c

.exe 2.3MB

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.c837a47acf8a7ccbae6199776e8d7a7c

IMPHASH af781605dc994d81146bbd997b4ae7a7
SHA256 d0477dfa1db389fe571569662f1f7e88e43ee7eefe97a35e1dbf221d63acb532
MD5 c837a47acf8a7ccbae6199776e8d7a7c
SHA1 019a272d527e9cec0d92399d67b71fdfc227202c
SHA512 994f49d9dd1f3928da0356ec9c69df548a56d95e81df9dd686b5dc4e42781fbd0d6bcf482fd6ff93f22300bc259c40a79ac170c9519d9d848a74baf58bd9195d
SSDEEP 24576:eo/Pvvkx9xsINzJdIHj63ZNV0POmdMPFCBAk2v8:eokpdbpIT4M
TLSH
T13BB5CF33EEED8DBDE85E0EB7E02D856444FFED20659060A2FD83FE2963352425634925
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

67226

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

shlwapi

StrCmpNW UrlCanonicalizeW PathStripToRootW PathRemoveFileSpecW PathRemoveBlanksW StrCmpNIW StrFormatByteSizeW StrStrW PathCanonicalizeW PathFindExtensionW PathFindFileNameW PathFindNextComponentW PathIsRelativeW PathIsUNCW PathIsURLW

user32

SetDlgItemInt ToAsciiEx BringWindowToTop DeferWindowPos SetWindowPos CallWindowProcW AttachThreadInput DrawMenuBar CreateMenu InvalidateRect SetScrollPos GetPropW GetWindowRect AdjustWindowRectEx ShowCursor HideCaret GetSysColor FrameRect SetRect GetWindowLongW GetClassLongW EndDialog

secur32

QuerySecurityPackageInfoW TranslateNameW FreeContextBuffer FreeCredentialsHandle

kernel32

SetLastError CloseHandle WriteConsoleW SetFilePointerEx SetStdHandle GetConsoleMode GetConsoleCP FlushFileBuffers HeapSize HeapReAlloc HeapAlloc GetStringTypeW OutputDebugStringW RtlUnwind LoadLibraryExW LeaveCriticalSection EnterCriticalSection GetCPInfo GetOEMCP GetACP IsValidCodePage IsDebuggerPresent IsProcessorFeaturePresent TlsFree TlsSetValue TlsGetValue TlsAlloc TerminateProcess GetCurrentProcess Sleep InitializeCriticalSectionAndSpinCount SetUnhandledExceptionFilter GlobalLock GlobalFree VirtualAlloc HeapFree GetEnvironmentStringsW LoadResource FormatMessageW lstrcmpW lstrcmpiW CreateMutexW GetModuleHandleW GetTempPathW RemoveDirectoryW GetFullPathNameW CompareStringW LCMapStringW GetConsoleWindow GetCommandLineW RaiseException EncodePointer GetLastError CreateFileW GetCurrentThreadId DecodePointer ExitProcess GetModuleHandleExW GetProcAddress MultiByteToWideChar WideCharToMultiByte GetProcessHeap GetStdHandle GetFileType DeleteCriticalSection GetStartupInfoW GetModuleFileNameW WriteFile QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime FreeEnvironmentStringsW UnhandledExceptionFilter

Name

.text

Size

104KB

Virtual Size

103KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

493KB

Virtual Size

7.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1024B

Virtual Size

724B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.35dk

Size

563KB

Virtual Size

563KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.ax12

Size

568KB

Virtual Size

567KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.o1c6o

Size

266KB

Virtual Size

266KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

362KB

Virtual Size

362KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.c837a47acf8a7ccbae6199776e8d7a7c

shlwapi

user32

secur32

kernel32

generic