jaffacakes118_not-a-virus[.]HEUR[.]AdWare[.]Win32[.]iBryte[.]heur[.]1123ec52d5d682cb5d21ca89c041756f

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.iBryte.heur.1123ec52d5d682cb5d21ca89c041756f
Size 581KB
Sample261014-fgk81swt5m
SHA256 0edda19f768597d4b2f246dc8ad0e46e9df04f5a47a77af219bd0c5a834ff1fc
MD5 1123ec52d5d682cb5d21ca89c041756f
SHA1 553d7b428b07f2c1cd11ee5b01581f7bbdd75cf6
SHA512 a9c1757bf34859acd1bfd26e864629b93116f1ccb72a50b1c718db1ed9d14096923f85bd9eb78dcd1b53c8d4766875688307b445e2c7d4cf9af9ed8d0f949031
SSDEEP 12288:bDlZNcJaOcOmbFrtWD6kFX9wwf0EhpBeIOlvXd6pKD:bDlZUaOcZbFrtpkFX50EhpBTUvXdD
TLSH
T1FEC48C263BB1D036D26261B189A6C271E7B6BC705C3646C77EC1373D2F346829B29736
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.iBryte.heur.1123ec52d5d682cb5d21ca89c041756f

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.iBryte.heur.1123ec52d5d682cb5d21ca89c041756f

.exe 581KB

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.iBryte.heur.1123ec52d5d682cb5d21ca89c041756f

IMPHASH 66eb78f47b4139ab2c3326e8c67bb7a9
SHA256 0edda19f768597d4b2f246dc8ad0e46e9df04f5a47a77af219bd0c5a834ff1fc
MD5 1123ec52d5d682cb5d21ca89c041756f
SHA1 553d7b428b07f2c1cd11ee5b01581f7bbdd75cf6
SHA512 a9c1757bf34859acd1bfd26e864629b93116f1ccb72a50b1c718db1ed9d14096923f85bd9eb78dcd1b53c8d4766875688307b445e2c7d4cf9af9ed8d0f949031
SSDEEP 12288:bDlZNcJaOcOmbFrtWD6kFX9wwf0EhpBeIOlvXd6pKD:bDlZUaOcZbFrtpkFX50EhpBTUvXdD
TLSH
T1FEC48C263BB1D036D26261B189A6C271E7B6BC705C3646C77EC1373D2F346829B29736
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

70:36:2a:58:ef:ec:d5:0c:8c:26:6c:93:e0:1e:3a:34:6f:c8:b9:9d

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Optimum Installer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Optimum Installer,L=Kansas City,ST=Missouri,C=US

Chains

Oct 7, 2026

CN=Optimum Installer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Optimum Installer,L=Kansas City,ST=Missouri,C=US

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Serial Number

3c:91:31:cb:1f:f6:d0:1b:0e:9a:b8:d0:44:bf:12:be

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Timespan

Jan 29, 1996 - Aug 2, 2028

Subject

Serial Number

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

Serial Number

18:da:d1:9e:26:7d:e8:bb:4a:21:58:cd:cc:6b:3b:4a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 8, 2006 - Jul 16, 2036

Subject

CN=Optimum Installer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Optimum Installer,L=Kansas City,ST=Missouri,C=US

Serial Number

08:09:95:65:35:a8:89:f9:93:1b:de:f1:0f:f6:81:4a

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 8, 2011 - Nov 7, 2012

Subject

CN=Optimum Installer,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Optimum Installer,L=Kansas City,ST=Missouri,C=US

Serial Number

7c:5f:27:b7:76:ad:bb:b7:94:3f:70:00:66:a4:90:bf

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 11, 2012 - Nov 7, 2013

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

279792

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

gdiplus

GdipGetImageEncoders GdipGetImageEncodersSize GdipCreateHBITMAPFromBitmap GdipCreateBitmapFromStreamICM GdipCloneImage GdiplusStartup GdipDisposeImage GdipLoadImageFromFileICM GdipLoadImageFromFile GdipAlloc GdipFree GdipCreateBitmapFromStream GdiplusShutdown GdipSaveImageToStream

rpcrt4

UuidCreate

kernel32

GetFileSizeEx GetFileTime WritePrivateProfileStringA FreeResource lstrcmpW GlobalFindAtomA GlobalGetAtomNameA DeleteCriticalSection LocalAlloc TlsGetValue GlobalReAlloc GlobalHandle TlsAlloc TlsSetValue LocalReAlloc TlsFree GetModuleHandleW InterlockedIncrement GetCurrentDirectoryA GlobalFlags SetErrorMode GetCPInfo GetOEMCP UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RaiseException HeapFree RtlUnwind GetSystemTimeAsFileTime ExitProcess GetFileAttributesA GetDriveTypeA GetCommandLineA GetStartupInfoA VirtualProtect VirtualAlloc GetSystemInfo VirtualQuery HeapReAlloc ExitThread CreateThread HeapSize SetStdHandle GetFileType HeapCreate VirtualFree SetHandleCount GetStdHandle GetConsoleCP GetConsoleMode GetACP IsValidCodePage LCMapStringA LCMapStringW InitializeCriticalSectionAndSpinCount GetFileInformationByHandle PeekNamedPipe FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTimeZoneInformation GetStringTypeA GetStringTypeW WriteConsoleA GetConsoleOutputCP WriteConsoleW GetUserDefaultLCID EnumSystemLocalesA IsValidLocale GetLocaleInfoW GetProcessHeap CompareStringW SetEnvironmentVariableA GetFileAttributesExA FileTimeToLocalFileTime FileTimeToSystemTime FindNextFileA CreateFileA GetFullPathNameA GetVolumeInformationA FindFirstFileA FindClose GetCurrentProcess DuplicateHandle GetFileSize SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer WriteFile ReadFile GetThreadLocale GetCurrentProcessId GlobalAddAtomA CreateEventA SuspendThread SetEvent ResumeThread SetThreadPriority InterlockedDecrement GetModuleFileNameW GlobalDeleteAtom GetCurrentThread GetCurrentThreadId ConvertDefaultLocale EnumResourceLanguagesA GetLocaleInfoA LoadLibraryExA CompareStringA InterlockedExchange lstrcmpA GlobalFree GlobalAlloc GlobalLock GlobalUnlock LocalFree MulDiv lstrlenA SetLastError lstrcpynA CreateProcessA EnterCriticalSection LeaveCriticalSection FormatMessageA InitializeCriticalSection GetTempFileNameA DeleteFileA CreateDirectoryA GetTickCount MultiByteToWideChar LoadLibraryA GetProcAddress FreeLibrary WaitForSingleObject CloseHandle GetModuleHandleA GetVersionExA CreateToolhelp32Snapshot GetLastError Process32First Process32Next OpenProcess GetExitCodeProcess TerminateProcess GetSystemDirectoryA GetWindowsDirectoryA GetTempPathA GetModuleFileNameA RemoveDirectoryA Sleep WideCharToMultiByte FindResourceA LoadResource LockResource SizeofResource HeapAlloc CreateFileW

user32

GetSysColorBrush SetCapture UnregisterClassA CharNextA CopyAcceleratorTableA IsRectEmpty SetRect InvalidateRgn GetNextDlgGroupItem MessageBeep RegisterClipboardFormatA PostThreadMessageA GetClassNameA SetPropA GetPropA RemovePropA GetForegroundWindow BeginDeferWindowPos EndDeferWindowPos GetTopWindow GetMessageTime GetMessagePos MapWindowPoints TrackPopupMenu SetMenu GetClassInfoExA GetClassInfoA RegisterClassA AdjustWindowRectEx EqualRect DeferWindowPos CopyRect DefWindowProcA CallWindowProcA GetMenu OffsetRect IntersectRect SystemParametersInfoA GetWindowPlacement GetWindowRect GetSysColor EndPaint BeginPaint GetWindowDC ClientToScreen ScreenToClient FillRect GetDesktopWindow DestroyWindow GetNextDlgTabItem EndDialog SetWindowContextHelpId MapDialogRect CharUpperA GetWindowTextA SetWindowPos GetCapture ShowWindow MoveWindow SetWindowLongA GetDlgCtrlID SetWindowTextA IsDialogMessageA SendDlgItemMessageA GetDlgItem GetWindow GetWindowThreadProcessId GetWindowLongA GetLastActivePopup IsWindowEnabled MessageBoxA ShowOwnedPopups SetWindowsHookExA CallNextHookEx GetMessageA TranslateMessage DispatchMessageA GetActiveWindow IsWindowVisible GetKeyState PeekMessageA GetCursorPos ValidateRect SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapA GetFocus GetParent ModifyMenuA CheckMenuItem UnhookWindowsHookEx PostQuitMessage GetMenuState GetMenuItemID GetMenuItemCount GetSubMenu GrayStringA DrawTextExA DrawTextA TabbedTextOutA GetSystemMenu EnableMenuItem CloseWindow GetMenuItemInfoA UnpackDDElParam ReuseDDElParam LoadMenuA DestroyMenu ReleaseCapture LoadAcceleratorsA KillTimer SetTimer InsertMenuItemA CreatePopupMenu SetRectEmpty TranslateAcceleratorA InflateRect RegisterWindowMessageA WinHelpA CreateDialogIndirectParamA IsChild PostMessageA GetDC ReleaseDC IsWindow GetKeyboardState keybd_event SetForegroundWindow BringWindowToTop SetActiveWindow GetSystemMetrics LoadStringA CreateWindowExA LoadCursorA SetCursor LoadIconA EnableWindow InvalidateRect GetClientRect IsIconic SendMessageA DrawIcon PtInRect UpdateWindow SetFocus GetClassLongA

gdi32

GetPixel SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowOrgEx SetWindowExtEx ScaleWindowExtEx ExtSelectClipRgn GetViewportExtEx CreateSolidBrush CreateRectRgnIndirect GetTextExtentPoint32A GetTextColor GetRgnBox DeleteDC GetWindowExtEx GetMapMode GetBkColor SetStretchBltMode StretchBlt CreateCompatibleBitmap GetDeviceCaps GetCurrentObject CreateCompatibleDC SelectObject BitBlt DeleteObject GetStockObject GetObjectA CreatePatternBrush CreateFontIndirectA GetClipBox SetMapMode SetTextColor SetBkMode SetBkColor RestoreDC SaveDC CreateBitmap Escape ExtTextOutA TextOutA RectVisible PtVisible LPtoDP DPtoLP

comdlg32

GetFileTitleA

winspool.drv

DocumentPropertiesA ClosePrinter OpenPrinterA

advapi32

RegOpenKeyA RegSetValueExA RegCreateKeyExA RegQueryValueA RegCloseKey RegEnumKeyA RegDeleteKeyA RegQueryInfoKeyA RegOpenKeyExA RegQueryValueExA

shell32

SHGetFolderPathA Shell_NotifyIconA DragFinish DragQueryFileA ShellExecuteA

comctl32

ord17

shlwapi

PathFindFileNameA PathFindExtensionA PathStripToRootA PathIsUNCA UrlUnescapeA AssocQueryStringA

oledlg

ord8

ole32

OleUninitialize CoFreeUnusedLibraries CoTaskMemFree StringFromCLSID CreateStreamOnHGlobal CoTaskMemAlloc CLSIDFromProgID CLSIDFromString CoGetClassObject StgOpenStorageOnILockBytes StgCreateDocfileOnILockBytes CreateILockBytesOnHGlobal CoRegisterMessageFilter OleFlushClipboard OleIsCurrentClipboard CoRevokeClassObject OleInitialize

oleaut32

SafeArrayDestroy VariantCopy VariantInit VariantChangeType VariantClear SysAllocStringLen SysAllocStringByteLen SysStringLen VariantTimeToSystemTime SystemTimeToVariantTime OleCreateFontIndirect SysAllocString SysFreeString

urlmon

URLDownloadToFileA

wininet

InternetCrackUrlA HttpOpenRequestA InternetConnectA HttpSendRequestA InternetReadFile InternetWriteFile InternetSetFilePointer InternetSetStatusCallback InternetOpenA InternetGetLastResponseInfoA InternetCloseHandle HttpQueryInfoA HttpAddRequestHeadersA InternetCanonicalizeUrlA InternetQueryDataAvailable

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.iBryte.heur.1123ec52d5d682cb5d21ca89c041756f

PE Signature issue

gdiplus

rpcrt4

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

urlmon

wininet

generic