jaffacakes118_not-a-virus[.]HEUR[.]AdWare[.]Win32[.]UpdChecker[.]gen[.]9dacf05eb50032da7ef1b2f72f024960

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.UpdChecker.gen.9dacf05eb50032da7ef1b2f72f024960
Size 715KB
Sample261014-fet35swt2k
SHA256 f47bdf2bc26838b8abc37502436393730d59cbcedd85ee6aa270ae79c1dc5f6e
MD5 9dacf05eb50032da7ef1b2f72f024960
SHA1 3a116df80cb29081eb48da0942952c826af21060
SHA512 245c10ba263ed3365db0d0ed30426fec9c11b9414fa870daf7ce7738036bfec784878908b2fe78786727b6eb1b08f3a8cf2726f5cf54fd36f4aacec2a88328d6
SSDEEP 12288:JHdIDENa2q5TdBO8cTTcFnzdtcCs57mtEFvHJ0RquO78jQ+X:J9e2ypBODTiI6YvpCjQ+X
TLSH
T179F47C11B681C031E7A703B54969D7BA4939AE310314A5CFE3D43D7A5E712E3AA3728F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.UpdChecker.gen.9dacf05eb50032da7ef1b2f72f024960

.exe 715KB

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.UpdChecker.gen.9dacf05eb50032da7ef1b2f72f024960

IMPHASH 6196278d2c50e19f4230e3c8881b3be7
SHA256 f47bdf2bc26838b8abc37502436393730d59cbcedd85ee6aa270ae79c1dc5f6e
MD5 9dacf05eb50032da7ef1b2f72f024960
SHA1 3a116df80cb29081eb48da0942952c826af21060
SHA512 245c10ba263ed3365db0d0ed30426fec9c11b9414fa870daf7ce7738036bfec784878908b2fe78786727b6eb1b08f3a8cf2726f5cf54fd36f4aacec2a88328d6
SSDEEP 12288:JHdIDENa2q5TdBO8cTTcFnzdtcCs57mtEFvHJ0RquO78jQ+X:J9e2ypBODTiI6YvpCjQ+X
TLSH
T179F47C11B681C031E7A703B54969D7BA4939AE310314A5CFE3D43D7A5E712E3AA3728F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

e7:87:b0:5c:28:47:6a:a8:7f:82:24:5f:15:3e:85:a1:87:30:cd:e7:c4:47:6a:91:f5:8f:bd:6c:06:54:b4:d5

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=上海广乐网络科技有限公司,OU=技术,O=上海广乐网络科技有限公司,L=上海,ST=上海,C=CN

Chains

May 3, 2018

CN=上海广乐网络科技有限公司,OU=技术,O=上海广乐网络科技有限公司,L=上海,ST=上海,C=CN

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

51:10:0c:42:26:15:06:91:34:60:c2:f7:83:75:4b:88:81:69:26:35

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=上海广乐网络科技有限公司,OU=技术,O=上海广乐网络科技有限公司,L=上海,ST=上海,C=CN

Chains

May 3, 2018

CN=上海广乐网络科技有限公司,OU=技术,O=上海广乐网络科技有限公司,L=上海,ST=上海,C=CN

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

Serial Number

1b:09:3b:78:60:96:da:37:bb:a4:51:94:46:c8:96:78

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=上海广乐网络科技有限公司,OU=技术,O=上海广乐网络科技有限公司,L=上海,ST=上海,C=CN

Serial Number

07:8f:d1:48:0a:d2:92:72:fb:1f:57:61:4e:67:02:0e

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 4, 2017 - Oct 1, 2019

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=上海广乐网络科技有限公司,OU=技术,O=上海广乐网络科技有限公司,L=上海,ST=上海,C=CN

Serial Number

34:cb:7f:a7:1d:10:18:43:27:bd:00:97:c4:b3:0a:c0

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 2, 2017 - Oct 1, 2019

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

Major OS version

Entry point

147034

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

FileTimeToSystemTime FindClose FileTimeToLocalFileTime GetDriveTypeA FindFirstFileA ExitThread GetFileInformationByHandle GetFullPathNameA GetCurrentDirectoryA Sleep CreateMutexW GetLocalTime GetLastError CloseHandle CreateProcessA GetTickCount GetProcAddress LoadLibraryW GetModuleHandleExW GetModuleFileNameW GetTempPathA WaitForMultipleObjects PeekNamedPipe SleepEx VerSetConditionMask VerifyVersionInfoA FormatMessageA SetEnvironmentVariableA CompareStringW CompareStringA GetProcessHeap SetStdHandle InterlockedIncrement InterlockedDecrement WideCharToMultiByte InterlockedExchange InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection MultiByteToWideChar CreateThread WaitForSingleObject CreateFileW GetModuleFileNameA DeleteFileA MoveFileExA CreateToolhelp32Snapshot Process32FirstW lstrcmpiA Process32NextW TerminateProcess FreeLibrary ExpandEnvironmentStringsA LoadLibraryA ReadFile GetCurrentThreadId SetEndOfFile SetConsoleCtrlHandler FreeConsole GetStdHandle GetConsoleMode WriteConsoleA CreateFileA WriteFile SetFilePointer GetSystemTimeAsFileTime GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapFree GetStartupInfoW RaiseException RtlUnwind LCMapStringA LCMapStringW GetCPInfo HeapAlloc HeapReAlloc MoveFileA GetModuleHandleW ExitProcess TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError HeapSize GetTimeZoneInformation GetACP GetOEMCP IsValidCodePage HeapCreate HeapDestroy VirtualFree VirtualAlloc FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA QueryPerformanceCounter GetCurrentProcessId GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetStringTypeA GetStringTypeW GetConsoleCP FlushFileBuffers InitializeCriticalSectionAndSpinCount GetModuleHandleA GetLocaleInfoW GetConsoleOutputCP WriteConsoleW

ole32

StringFromCLSID CoCreateGuid

shlwapi

StrStrIA PathFileExistsA PathFileExistsW PathStripPathA

imagehlp

MakeSureDirectoryPathExists

ws2_32

WSASetLastError WSAStartup WSACleanup __WSAFDIsSet WSAGetLastError select recv send WSAIoctl setsockopt getsockname ntohl htonl gethostname ioctlsocket ntohs bind htons getsockopt getpeername closesocket connect freeaddrinfo getaddrinfo sendto recvfrom accept listen socket

wldap32

ord35 ord46 ord27 ord301 ord33 ord79 ord32 ord200 ord30 ord26 ord50 ord60 ord143 ord211 ord22 ord41

user32

GetMonitorInfoW WindowFromPoint GetSystemMetrics

advapi32

CryptDestroyHash CryptGetHashParam CryptHashData CryptCreateHash CryptAcquireContextW RegCloseKey RegOpenKeyExW RegOpenCurrentUser RegOpenKeyExA RegQueryValueExA RegSetValueExA RegDeleteValueA RegCreateKeyExA CryptImportKey CryptEncrypt CryptDestroyKey CryptAcquireContextA CryptGenRandom CryptReleaseContext

shell32

ShellExecuteA

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.UpdChecker.gen.9dacf05eb50032da7ef1b2f72f024960

PE Signature issue

kernel32

ole32

shlwapi

imagehlp

ws2_32

wldap32

user32

advapi32

shell32

generic