jaffacakes118_not-a-virus[.]HEUR[.]AdWare[.]Win32[.]DownloadHelper[.]gen[.]e7081ae845fcf80748c3df45fbbc0561

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.e7081ae845fcf80748c3df45fbbc0561
Size 2.5MB
Sample261014-ezwl2aed94
SHA256 8f7457402f4cdb8440fa2c3130f5d3d2087752d3457786b8a4c8241304180415
MD5 e7081ae845fcf80748c3df45fbbc0561
SHA1 5df09076330d3b4ee663fb6022bfeab15150b348
SHA512 372a2ec70809fa3bda91685e1ae3e5db0dedc33951533c4e3839df6ae254f24467ede5255331798b2ae0eb2d6fe7ad7e748fd5647ea7e10a9f9d7c996057d455
SSDEEP 24576:Xoh91tU/OnlV49pHK1gBq2FRv2Xgejsfu3lWHuz:YhSGl281g/v2LjakX
TLSH
T1B8C50109B281C463E4B396F8177797E44BAC7E615A64C98332C0BF1E647D1A3BE25F42
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.e7081ae845fcf80748c3df45fbbc0561

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.e7081ae845fcf80748c3df45fbbc0561

.exe 2.5MB

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.e7081ae845fcf80748c3df45fbbc0561

IMPHASH cd90e46c28274f9a8b9e1c40082e1827
SHA256 8f7457402f4cdb8440fa2c3130f5d3d2087752d3457786b8a4c8241304180415
MD5 e7081ae845fcf80748c3df45fbbc0561
SHA1 5df09076330d3b4ee663fb6022bfeab15150b348
SHA512 372a2ec70809fa3bda91685e1ae3e5db0dedc33951533c4e3839df6ae254f24467ede5255331798b2ae0eb2d6fe7ad7e748fd5647ea7e10a9f9d7c996057d455
SSDEEP 24576:Xoh91tU/OnlV49pHK1gBq2FRv2Xgejsfu3lWHuz:YhSGl281g/v2LjakX
TLSH
T1B8C50109B281C463E4B396F8177797E44BAC7E615A64C98332C0BF1E647D1A3BE25F42
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51452

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW

winspool.drv

StartDocPrinterW

user32

CharNextW CharPrevW MapVirtualKeyW SetCapture EnableWindow LoadAcceleratorsW CharUpperW CreateMenu EnableMenuItem DeleteMenu DrawIcon GetWindowRect EndPaint GetNextDlgTabItem DefWindowProcW DrawEdge ClientToScreen GetMenu GetDCEx DdeGetLastError DdeQueryNextServer MapDialogRect CopyImage LoadIconW GetClassLongW InvertRect

kernel32

GetModuleHandleExW CloseHandle WriteConsoleW SetFilePointerEx SetStdHandle GetConsoleMode GetConsoleCP FlushFileBuffers GlobalAlloc GlobalUnlock VirtualAlloc HeapAlloc HeapSize ExitProcess GetProcessId DeleteCriticalSection SizeofResource LockFile GetLocalTime LocalFileTimeToFileTime TlsFree ExpandEnvironmentStringsW GetFullPathNameW GetVersionExW GetConsoleWindow LCMapStringW HeapReAlloc GetStringTypeW OutputDebugStringW RtlUnwind LoadLibraryExW HeapFree LeaveCriticalSection EnterCriticalSection GetCPInfo GetOEMCP GetACP IsValidCodePage IsDebuggerPresent IsProcessorFeaturePresent GetModuleHandleW GetCommandLineW RaiseException EncodePointer GetLastError SetLastError GetCurrentThreadId DecodePointer CreateFileW GetProcAddress MultiByteToWideChar WideCharToMultiByte GetProcessHeap GetStdHandle GetFileType GetStartupInfoW GetModuleFileNameW WriteFile QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount Sleep GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue

ntdsapi

DsFreeNameResultW

mprapi

MprConfigInterfaceDelete MprConfigInterfaceGetInfo MprConfigInterfaceEnum

comctl32

FlatSB_SetScrollProp FlatSB_GetScrollPos CreateStatusWindowW ImageList_GetIconSize ImageList_Read ImageList_DragShowNolock ImageList_DragMove ImageList_DragLeave ImageList_DragEnter ImageList_EndDrag ImageList_Copy ImageList_LoadImageW ImageList_Remove ImageList_AddMasked ImageList_Draw ImageList_ReplaceIcon ord17 CreatePropertySheetPageW

Name

.text

Size

88KB

Virtual Size

88KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

562KB

Virtual Size

7.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1024B

Virtual Size

724B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.mhe8y

Size

290KB

Virtual Size

290KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ibnma

Size

871KB

Virtual Size

870KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.sarpu

Size

382KB

Virtual Size

382KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

362KB

Virtual Size

362KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.e7081ae845fcf80748c3df45fbbc0561

advapi32

winspool.drv

user32

kernel32

ntdsapi

mprapi

comctl32

generic