jaffacakes118_not-a-virus[.]HEUR[.]AdWare[.]Win32[.]OutBrowse[.]gen[.]f37a6efaa28c890121bedbba60a6802a

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.OutBrowse.gen.f37a6efaa28c890121bedbba60a6802a
Size 288KB
Sample261014-fdc38sws8n
SHA256 4a5b351b29853543dd53bd4ee710b63ffbf37677f650d004333bfa12921c7c34
MD5 f37a6efaa28c890121bedbba60a6802a
SHA1 eca1335c8514437c3c5c22f7bb86bc7848d04888
SHA512 8cd4edd7c3a7c6463f9c444b77e1022e84ea68c29ec2701a337e3ef2eb297f6c7f7e8d02c2993a685dbca64dfa444103275b3f96a4edecc8588b10eae2114c8e
SSDEEP 6144:FFJ0P7Fzx6zl/zSOyMmouBWL6qzw/hmvDwrW+MVwG:wRYx9vmoZL6qzw/hADW7y3
TLSH
T174541242ABD04E6BFFE1C9709276B5A2C777859523EB0043A3300DBE3867696D7847D2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

installer

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.OutBrowse.gen.f37a6efaa28c890121bedbba60a6802a
unpack001/beffabfhed.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.OutBrowse.gen.f37a6efaa28c890121bedbba60a6802a

.exe 288KB
beffabfhed.exe

.exe 569KB

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.OutBrowse.gen.f37a6efaa28c890121bedbba60a6802a

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 4a5b351b29853543dd53bd4ee710b63ffbf37677f650d004333bfa12921c7c34
MD5 f37a6efaa28c890121bedbba60a6802a
SHA1 eca1335c8514437c3c5c22f7bb86bc7848d04888
SHA512 8cd4edd7c3a7c6463f9c444b77e1022e84ea68c29ec2701a337e3ef2eb297f6c7f7e8d02c2993a685dbca64dfa444103275b3f96a4edecc8588b10eae2114c8e
SSDEEP 6144:FFJ0P7Fzx6zl/zSOyMmouBWL6qzw/hmvDwrW+MVwG:wRYx9vmoZL6qzw/hADW7y3
TLSH
T174541242ABD04E6BFFE1C9709276B5A2C777859523EB0043A3300DBE3867696D7847D2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

beffabfhed.exe

IMPHASH f53680fcb218606fb91bea46d53ac736
SHA256 29ae9d682ff68d8498a0df37dd1f5dc4dc23879dda47f29f491d4a53890b3321
MD5 b193af3d0371b5f27523ab5a836ada96
SHA1 073907e2dd63de28c4cadc9db94450a5648eea73
SHA512 fa95dbde32691ad06e72fa2020382dea651a23a5caec66fabac3e847e9bafb0e8b9b5bbce708cfb89cf24403f64190328d9b2dee398e3bab0aeb0366513ff159
SSDEEP 12288:rLqKzrU3VEPS26dgPxsUeaYPFPmyqDseCwr5FS/TsR+:r+FIsvaYPFPmvlCwG
TLSH
T181C44B187AB5C13AE1B682F19AACDB15507E6831175A15C3F3C94F2D1970CD2AF32A3B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

310738

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

winhttp

WinHttpCrackUrl WinHttpOpen WinHttpConnect WinHttpReadData WinHttpWriteData WinHttpQueryDataAvailable WinHttpSetOption WinHttpSetTimeouts WinHttpOpenRequest WinHttpAddRequestHeaders WinHttpSendRequest WinHttpReceiveResponse WinHttpQueryHeaders WinHttpGetProxyForUrl WinHttpGetIEProxyConfigForCurrentUser WinHttpCloseHandle

kernel32

GlobalLock GlobalUnlock FlushInstructionCache GetCurrentProcess ExitProcess RaiseException GetCurrentThreadId GetLastError SetLastError EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection LoadResource MulDiv lstrcmpW GetModuleFileNameW FindResourceW MultiByteToWideChar GetCommandLineW GlobalHandle GlobalFree CreateThread GetVersion GetExitCodeProcess WaitForSingleObject Sleep FindClose CloseHandle CreateProcessW DeleteFileW FindFirstFileW FindNextFileW IsWow64Process WideCharToMultiByte SetEvent GlobalAlloc HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap LocalFree FormatMessageW DecodePointer TlsAlloc TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetStringTypeW GetCPInfo GetOEMCP GetACP IsValidCodePage WriteFile GetStdHandle GetSystemTimeAsFileTime AreFileApisANSI GetProcAddress GetModuleHandleExW RtlUnwind EncodePointer OutputDebugStringW IsDebuggerPresent VirtualFree VirtualAlloc IsProcessorFeaturePresent InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead LockResource TlsFree GetStartupInfoW GetModuleHandleW LoadLibraryExW FlushFileBuffers GetConsoleCP GetConsoleMode TlsSetValue GetFileType ReadFile SetFilePointerEx GetTimeZoneInformation QueryPerformanceCounter GetCurrentProcessId InterlockedDecrement GetEnvironmentStringsW FreeEnvironmentStringsW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW SetEnvironmentVariableA SetStdHandle WriteConsoleW ReadConsoleW CreateFileW SetEndOfFile TlsGetValue CreateDirectoryW

user32

GetDesktopWindow SetWindowLongW FillRect GetSysColor LoadCursorW ClientToScreen GetParent MessageBoxA GetClientRect GetWindowTextLengthW GetWindowTextW SetWindowTextW GetClassNameW GetWindow MessageBoxW CreateDialogIndirectParamW EndDialog GetSystemMetrics GetWindowRect SetWindowContextHelpId MapDialogRect LoadStringW GetMessageW TranslateMessage DispatchMessageA PostThreadMessageW SetTimer KillTimer ScreenToClient RedrawWindow InvalidateRgn InvalidateRect EndPaint BeginPaint ReleaseDC GetDC UpdateWindow DestroyAcceleratorTable CreateAcceleratorTableW ReleaseCapture SetCapture GetFocus SetFocus CharNextW SendDlgItemMessageW GetDlgItem SetWindowPos MoveWindow ShowWindow DestroyWindow IsChild IsWindow CreateWindowExW GetClassInfoExW RegisterClassExW UnregisterClassW CallWindowProcW DefWindowProcW SendMessageW RegisterWindowMessageW PostMessageW GetWindowLongW

gdi32

SelectObject GetStockObject GetDeviceCaps DeleteObject BitBlt CreateCompatibleBitmap CreateCompatibleDC GetObjectW DeleteDC CreateSolidBrush

advapi32

RegQueryValueExW RegQueryInfoKeyW RegOpenKeyExW RegEnumKeyExW RegCreateKeyExW RegCloseKey RegSetValueExW

shell32

SHGetFolderPathW ShellExecuteW

ole32

CoGetClassObject CLSIDFromString CLSIDFromProgID StringFromGUID2 CoTaskMemAlloc CoTaskMemFree OleInitialize OleUninitialize OleLockRunning CreateStreamOnHGlobal CoInitialize CoUninitialize CoAddRefServerProcess CoReleaseServerProcess CoCreateInstance

oleaut32

DispCallFunc VariantCopy SysAllocStringByteLen SysStringByteLen OleCreateFontIndirect LoadRegTypeLi LoadTypeLi VariantClear VariantInit SysStringLen SysAllocStringLen SysFreeString SysAllocString

urlmon

URLDownloadToFileW

iphlpapi

GetAdaptersInfo

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.OutBrowse.gen.f37a6efaa28c890121bedbba60a6802a

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

beffabfhed.exe

winhttp

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

urlmon

iphlpapi

generic