jaffacakes118_not-a-virus[.]HEUR[.]AdWare[.]Win32[.]DownloadHelper[.]gen[.]e7d740b56f7be9fc218e76b2ce463868

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.e7d740b56f7be9fc218e76b2ce463868
Size 2.4MB
Sample261014-ezz98aytgs
SHA256 f828b692572d20f0a080c67b054aef723a0147184ffcf7d886ac31ac952e24d7
MD5 e7d740b56f7be9fc218e76b2ce463868
SHA1 da77dd0d16607da06326cda69c970e6c8fa6188f
SHA512 fbb2ef0db8393aab83a1a5de730580bce07a50bd5a2e30194f0a2105cc79e2cb31e8b0cf79a0ee22ae3bd18b1665886a8d71230354a3567b869b64a445d2ecf7
SSDEEP 49152:zNpEdnJD/Th9fYOi+bFPoyY5l/Um9ZkmbgE3goC41M/n1nb:HEZF9VYOi+YUm9ZkogE39d1Sl
TLSH
T1A4C5182AEFC3D997F5A300B4630EF395680A7A30503E5847FEE11F66B1AC442956AF17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.e7d740b56f7be9fc218e76b2ce463868

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.e7d740b56f7be9fc218e76b2ce463868

.exe 2.4MB

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.e7d740b56f7be9fc218e76b2ce463868

IMPHASH ea18b76ac913cae9f144a7f342e2c293
SHA256 f828b692572d20f0a080c67b054aef723a0147184ffcf7d886ac31ac952e24d7
MD5 e7d740b56f7be9fc218e76b2ce463868
SHA1 da77dd0d16607da06326cda69c970e6c8fa6188f
SHA512 fbb2ef0db8393aab83a1a5de730580bce07a50bd5a2e30194f0a2105cc79e2cb31e8b0cf79a0ee22ae3bd18b1665886a8d71230354a3567b869b64a445d2ecf7
SSDEEP 49152:zNpEdnJD/Th9fYOi+bFPoyY5l/Um9ZkmbgE3goC41M/n1nb:HEZF9VYOi+YUm9ZkogE39d1Sl
TLSH
T1A4C5182AEFC3D997F5A300B4630EF395680A7A30503E5847FEE11F66B1AC442956AF17
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1662057

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

user32

DragDetect DdeEnableCallback KillTimer

advapi32

RegOpenKeyExW RegSetValueExW RegQueryValueExW UnregisterTraceGuids RegEnumValueW RegCloseKey RegisterTraceGuidsW

kernel32

SetFilePointerEx GetLocaleInfoW InterlockedDecrement InterlockedExchange TlsFree HeapAlloc GetConsoleCP ReadFile GetCommandLineW LeaveCriticalSection ReleaseSemaphore WriteConsoleW GetLastError GetACP CreateEventW VirtualAlloc SystemTimeToFileTime PeekNamedPipe CreateMailslotW TlsGetValue CreateMutexW CancelIo IsDBCSLeadByteEx GetConsoleWindow SetStdHandle GetConsoleMode FlushFileBuffers LCMapStringW CloseHandle SetEndOfFile GetModuleHandleExW RaiseException IsDebuggerPresent IsProcessorFeaturePresent EncodePointer SetLastError GetCurrentThreadId DecodePointer ExitProcess CreateFileW GetProcAddress MultiByteToWideChar WideCharToMultiByte GetProcessHeap GetStdHandle GetFileType DeleteCriticalSection GetStartupInfoW GetModuleFileNameW WriteFile QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount Sleep GetCurrentProcess TerminateProcess TlsAlloc TlsSetValue GetModuleHandleW IsValidCodePage GetOEMCP GetCPInfo EnterCriticalSection HeapFree LoadLibraryExW RtlUnwind OutputDebugStringW GetStringTypeW HeapReAlloc HeapSize

wintrust

CryptCATAdminReleaseContext CryptCATAdminReleaseCatalogContext WinVerifyTrust CryptCATAdminEnumCatalogFromHash

wininet

InternetOpenUrlW

esent

JetSetIndexRange JetCloseTable

Name

.text

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

311KB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1024B

Virtual Size

724B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.Ageh9t

Size

342KB

Virtual Size

341KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.e1A3

Size

97KB

Virtual Size

96KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

34KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.e7d740b56f7be9fc218e76b2ce463868

user32

advapi32

kernel32

wintrust

wininet

esent

generic