jaffacakes118_not-a-virus[.]HEUR[.]AdWare[.]Win32[.]Imali[.]gen[.]dac5fbb7a6fe18b054746dae427d77d3

General

Target
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Imali.gen.dac5fbb7a6fe18b054746dae427d77d3
Size 2.7MB
Sample261014-fb6b1aee44
SHA256 462565a880f85a787503ac71a08284fb31a6dac153257845b1b2107aec95914a
MD5 dac5fbb7a6fe18b054746dae427d77d3
SHA1 6c2426cec23d9a4c1e287bf039eb158b4a329130
SHA512 acac82c2a6adf0e8a8a3deaa23295773376c70e26e13e186ab020f9bce45ae414f14321b82e3bd49dd8425742757a413859a93c24072cd4e16bf7d0e1320738f
SSDEEP 49152:lOfcsMc6EoBzTw6Gqqypj56G1LWMPFJRQ8EaI4EbN/uJyBjEt2fevm5Q:6oAoN6G1iKbW7aZQNWJyBXfevm5Q
TLSH
T1D4D51241A3D9C032E26D1974C96943F89E267C7007D350DB2FB8F91DCE766EB6839226
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

installer

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Imali.gen.dac5fbb7a6fe18b054746dae427d77d3

Inno Setup is an open-source installation builder for Windows applications. 1 IoCs

Inno Setup installer

installer

resource	yara_rule
sample	innosetup

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Imali.gen.dac5fbb7a6fe18b054746dae427d77d3

.exe 2.7MB

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Imali.gen.dac5fbb7a6fe18b054746dae427d77d3

IMPHASH d80b35c631ae37465b5ec7a986b3326b
SHA256 462565a880f85a787503ac71a08284fb31a6dac153257845b1b2107aec95914a
MD5 dac5fbb7a6fe18b054746dae427d77d3
SHA1 6c2426cec23d9a4c1e287bf039eb158b4a329130
SHA512 acac82c2a6adf0e8a8a3deaa23295773376c70e26e13e186ab020f9bce45ae414f14321b82e3bd49dd8425742757a413859a93c24072cd4e16bf7d0e1320738f
SSDEEP 49152:lOfcsMc6EoBzTw6Gqqypj56G1LWMPFJRQ8EaI4EbN/uJyBjEt2fevm5Q:6oAoN6G1iKbW7aZQNWJyBXfevm5Q
TLSH
T1D4D51241A3D9C032E26D1974C96943F89E267C7007D350DB2FB8F91DCE766EB6839226
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
Inno Setup is an open-source installation builder for Windows applications.

Inno Setup installer

installer

Minor OS version

1

Major OS version

5

Entry point

56393

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CloseHandle ExitProcess WaitForSingleObject GetLastError FreeLibrary GetProcAddress LoadLibraryW lstrcpyA GetTempPathA lstrcatW LockResource LoadResource SizeofResource FindResourceA lstrcpyW lstrlenW GetTempFileNameW GetTempPathW ReadFile GetFileSize CreateFileW GetModuleFileNameW GetCommandLineW SetEndOfFile InterlockedIncrement InterlockedDecrement Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection EncodePointer DecodePointer RtlUnwind WideCharToMultiByte RaiseException HeapFree GetCommandLineA HeapSetInformation GetStartupInfoW HeapAlloc LCMapStringW MultiByteToWideChar GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess IsProcessorFeaturePresent TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW SetLastError GetCurrentThreadId GetACP GetOEMCP IsValidCodePage SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType WriteFile GetConsoleCP GetConsoleMode SetFilePointer FlushFileBuffers HeapCreate GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime HeapSize GetLocaleInfoW GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetStringTypeW HeapReAlloc WriteConsoleW SetStdHandle GetProcessHeap

user32

MessageBoxA

Sharing