jaffacakes118_not-a-virus[.]HEUR[.]AdWare[.]Win32[.]DownloadHelper[.]gen[.]e6ef169e923f7aee59e789a2298aa924

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.e6ef169e923f7aee59e789a2298aa924
Size 2.5MB
Sample261014-eztsfaed93
SHA256 df424348759f6b0c3f6320e49e02a2332def10040187b82c9941ee4707bb2ba8
MD5 e6ef169e923f7aee59e789a2298aa924
SHA1 8e9445f7c576cf2dd15af8bacf458d13c25983c9
SHA512 8480501e6c2b1caa82d1e2b408478be7a46d91d7d3b4c5cd367a38af58f467c742f5b485b5ec565a6133b89e2cf7841f32bf3de3a61e365d1aff6826730287fc
SSDEEP 12288:PWsK+stQT0GVTzfFBh/O54tLj7uL8MuXgQU45KgPxRMKHOGM5AAcVJfo5rLL8xZY:PWYT0GVPFBh/OuTjZxRxvAFB/Eygt4
TLSH
T1D1C51200729AD826D86AD6FCDA69DE3570207DE22A51464F3ED5BF0F7B300939A11DCE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.e6ef169e923f7aee59e789a2298aa924

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.e6ef169e923f7aee59e789a2298aa924

.exe 2.5MB

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.e6ef169e923f7aee59e789a2298aa924

IMPHASH 1e57eb21a28fc914b5ba8bab25cbf6b3
SHA256 df424348759f6b0c3f6320e49e02a2332def10040187b82c9941ee4707bb2ba8
MD5 e6ef169e923f7aee59e789a2298aa924
SHA1 8e9445f7c576cf2dd15af8bacf458d13c25983c9
SHA512 8480501e6c2b1caa82d1e2b408478be7a46d91d7d3b4c5cd367a38af58f467c742f5b485b5ec565a6133b89e2cf7841f32bf3de3a61e365d1aff6826730287fc
SSDEEP 12288:PWsK+stQT0GVTzfFBh/O54tLj7uL8MuXgQU45KgPxRMKHOGM5AAcVJfo5rLL8xZY:PWYT0GVPFBh/OuTjZxRxvAFB/Eygt4
TLSH
T1D1C51200729AD826D86AD6FCDA69DE3570207DE22A51464F3ED5BF0F7B300939A11DCE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

44404

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

user32

DrawEdge SetMessageExtraInfo CreateIcon GetWindow GetClassNameW GetCaretBlinkTime ValidateRect GetDC DrawTextW DrawIcon CheckMenuItem DrawMenuBar IsWindowEnabled GetQueueStatus GetDlgCtrlID EndDialog SetWindowPlacement CallWindowProcW SendMessageW GetKeyboardLayout

kernel32

GetConsoleCP FlushFileBuffers LCMapStringW HeapSize HeapReAlloc HeapAlloc GetStringTypeW RtlUnwind GetVersion GetConsoleMode InitializeCriticalSection EnterCriticalSection ReadFile ClearCommBreak CreateMutexW GetModuleHandleW OutputDebugStringW CreateDirectoryW RemoveDirectoryW GetFileAttributesW BindIoCompletionCallback IsValidCodePage GetCPInfo LoadLibraryExW SetStdHandle SetFilePointerEx WriteConsoleW CloseHandle VirtualAlloc HeapFree GetCommandLineW RaiseException EncodePointer GetLastError SetLastError GetCurrentThreadId DecodePointer ExitProcess GetModuleHandleExW GetProcAddress CreateFileW MultiByteToWideChar WideCharToMultiByte GetProcessHeap GetStdHandle GetFileType DeleteCriticalSection GetStartupInfoW GetModuleFileNameW WriteFile QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount Sleep GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree IsProcessorFeaturePresent IsDebuggerPresent GetACP GetOEMCP LeaveCriticalSection

winspool.drv

StartDocPrinterW

advapi32

RegQueryInfoKeyW RegOpenKeyExW RegEnumValueW RegCloseKey OpenSCManagerW

psapi

GetDeviceDriverFileNameW GetModuleBaseNameW

Name

.text

Size

82KB

Virtual Size

81KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

714KB

Virtual Size

7.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1024B

Virtual Size

724B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.7in03

Size

159KB

Virtual Size

159KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.148a

Size

116KB

Virtual Size

116KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.i8s9

Size

499KB

Virtual Size

499KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.oga8

Size

391KB

Virtual Size

391KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.dh7l

Size

253KB

Virtual Size

253KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

362KB

Virtual Size

362KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.e6ef169e923f7aee59e789a2298aa924

user32

kernel32

winspool.drv

advapi32

psapi

generic