jaffacakes118_not-a-virus[.]HEUR[.]AdWare[.]Win32[.]DownloadHelper[.]gen[.]e69fcfbd512770c44a9d6b90a42edeb0

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.e69fcfbd512770c44a9d6b90a42edeb0
Size 1.2MB
Sample261014-ezryvaed92
SHA256 85451903fbf9da66dc2bec9f1b68ef0b7020b2cbf9486a4c354351c9aa0829ee
MD5 e69fcfbd512770c44a9d6b90a42edeb0
SHA1 0d222de9df85a2be7a4334c8b85f69ef52ab7a03
SHA512 226b4070d013ba7af4fafa3bfeb82c76a2d77465e6f7e175f56478fd1a4d4788f412bd79df713844d0956cc49309d8bbe3c8d4140286bccdbb109c7bc64a487f
SSDEEP 24576:1g/FEETrWXqhkMvOdGOJT6F8N+LBildBfjPcCT:SuE3RRylhNCildRjPcCT
TLSH
T13E451241B191C126D46D4A731B13FB3105AAFD223CF5885BF7D8FB2D56722C1A62A3A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.e69fcfbd512770c44a9d6b90a42edeb0

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.e69fcfbd512770c44a9d6b90a42edeb0

.exe 1.2MB

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.e69fcfbd512770c44a9d6b90a42edeb0

IMPHASH 4efb10d71ea0eed8a6bc11bbf6546b1b
SHA256 85451903fbf9da66dc2bec9f1b68ef0b7020b2cbf9486a4c354351c9aa0829ee
MD5 e69fcfbd512770c44a9d6b90a42edeb0
SHA1 0d222de9df85a2be7a4334c8b85f69ef52ab7a03
SHA512 226b4070d013ba7af4fafa3bfeb82c76a2d77465e6f7e175f56478fd1a4d4788f412bd79df713844d0956cc49309d8bbe3c8d4140286bccdbb109c7bc64a487f
SSDEEP 24576:1g/FEETrWXqhkMvOdGOJT6F8N+LBildBfjPcCT:SuE3RRylhNCildRjPcCT
TLSH
T13E451241B191C126D46D4A731B13FB3105AAFD223CF5885BF7D8FB2D56722C1A62A3A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

52103

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

user32

GetKeyboardLayout ExitWindowsEx PostThreadMessageW DdeSetUserHandle ImpersonateDdeClientWindow EnumDisplayMonitors TranslateMDISysAccel GetScrollInfo SetScrollInfo CreateIconIndirect DestroyCursor SetWindowsHookExW GetWindow FindWindowExW IsRectEmpty UnionRect IntersectRect GetSysColorBrush SetWindowTextW RemovePropW EnableScrollBar GetScrollRange SetScrollRange ScrollWindow LockWindowUpdate ExcludeUpdateRgn ReleaseDC GetWindowDC GetDC GetForegroundWindow UpdateWindow DrawMenuBar IsWindowEnabled EnableWindow MsgWaitForMultipleObjects ReleaseCapture SetCapture RegisterClipboardFormatW CheckRadioButton GetDlgItemTextW EndDialog DialogBoxParamW CreateDialogParamW EndDeferWindowPos BeginDeferWindowPos SetWindowPlacement ActivateKeyboardLayout

wintrust

CryptCATAdminReleaseCatalogContext CryptCATAdminReleaseContext

shlwapi

SHAutoComplete SHGetValueW SHDeleteValueW SHDeleteKeyW SHDeleteEmptyKeyW UrlEscapeW UrlUnescapeW UrlIsW PathStripToRootW StrDupW StrPBrkW StrRChrW StrCmpIW StrRetToStrW PathStripPathW PathRemoveBlanksW PathParseIconLocationW PathIsNetworkPathW PathIsRootW PathIsDirectoryW PathGetDriveNumberW PathFindFileNameW PathFindExtensionW PathFileExistsW PathBuildRootW PathAppendW PathAddBackslashW SHStrDupW StrRetToBufW StrCmpNW

kernel32

GetStringTypeW HeapReAlloc OutputDebugStringW LoadLibraryExW IsDebuggerPresent GetOEMCP IsValidCodePage TlsFree TlsSetValue TlsGetValue TlsAlloc TerminateProcess Sleep HeapSize SetUnhandledExceptionFilter UnhandledExceptionFilter QueryPerformanceCounter WriteFile GetStartupInfoW DeleteCriticalSection GetFileType GetStdHandle GetProcessHeap WideCharToMultiByte MultiByteToWideChar GetModuleHandleExW ExitProcess DecodePointer EncodePointer SetLastError IsProcessorFeaturePresent GetCommandLineW LCMapStringW FlushFileBuffers GetConsoleCP GetConsoleMode SetStdHandle SetFilePointerEx WriteConsoleW CloseHandle InitializeCriticalSectionAndSpinCount LeaveCriticalSection GetConsoleWindow CompareStringW GetCPInfo GetACP GetVersionExW FindNextFileW GetFileAttributesW CreateDirectoryW GetSystemDirectoryW RtlUnwind GetProcAddress GetVersion GlobalAlloc GlobalFlags GlobalLock GlobalUnlock VirtualAlloc HeapDestroy HeapAlloc HeapFree GetCurrentProcess GetCurrentProcessId GetEnvironmentStringsW FreeEnvironmentStringsW GetCurrentThreadId GetLastError InitializeCriticalSection EnterCriticalSection CreateFileW GetCommMask GetSystemTimeAsFileTime GetLocalTime GetSystemInfo SystemTimeToFileTime FileTimeToSystemTime lstrcmpiW LoadLibraryW GetModuleFileNameW GetModuleHandleW ExpandEnvironmentStringsW FindResourceExW GetPrivateProfileIntW

secur32

GetUserNameExW DeleteSecurityContext InitializeSecurityContextW TranslateNameW

crypt32

CryptMsgGetParam CertGetCertificateContextProperty CertAddEncodedCertificateToStore CertAddCertificateContextToStore CertFreeCTLContext CertAddStoreToCollection CertControlStore CertFindExtension CryptExportPublicKeyInfo CryptAcquireCertificatePrivateKey CryptHashPublicKeyInfo CertGetNameStringW CryptStringToBinaryW CryptBinaryToStringW CertFreeCertificateContext