jaffacakes118_not-a-virus[.]HEUR[.]Downloader[.]Win32[.]DownloaderGuide[.]gen[.]b7eba9efb7ff38839358f

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_not-a-virus.HEUR.Downloader.Win32.DownloaderGuide.gen.b7eba9efb7ff38839358f
Size 547KB
Sample261014-flel2ayxbx
SHA256 fa6a60aaf64c009920af64c9979aea9cab04d4a11ca63230b3b414b20de8a9f9
MD5 cc91492766db7eba9efb7ff38839358f
SHA1 9217b56c6221e22154072caebefeda7ae681e9b0
SHA512 6bb3ac09c1733cdfb3eb09dd9c23f68e7065101fb2a435454ab1d7cfa4c7138d0318a6af62e5c580f2cbb45d54958e3cf8b61a7c7f777451d122e7de75976bd0
SSDEEP 12288:x4fmuV/2SlI1MCAHab5I0WozQsmknY87Z1EPclMkc9A7Z2x:x42DMCA6b5fWQmknY87LEPcl9nlQ
TLSH
T113C47D2BB255E277D46308B25F9BA33B04799732A52D9502B3542E1FEB703E0A72435F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
jaffacakes118_not-a-virus.HEUR.Downloader.Win32.DownloaderGuide.gen.b7eba9efb7ff38839358f

File Explorer

jaffacakes118_not-a-virus.HEUR.Downloader.Win32.DownloaderGuide.gen.b7eba9efb7ff38839358f

.exe 547KB

jaffacakes118_not-a-virus.HEUR.Downloader.Win32.DownloaderGuide.gen.b7eba9efb7ff38839358f

IMPHASH 24f4613d0395ec689682abd0a1f8a028
SHA256 fa6a60aaf64c009920af64c9979aea9cab04d4a11ca63230b3b414b20de8a9f9
MD5 cc91492766db7eba9efb7ff38839358f
SHA1 9217b56c6221e22154072caebefeda7ae681e9b0
SHA512 6bb3ac09c1733cdfb3eb09dd9c23f68e7065101fb2a435454ab1d7cfa4c7138d0318a6af62e5c580f2cbb45d54958e3cf8b61a7c7f777451d122e7de75976bd0
SSDEEP 12288:x4fmuV/2SlI1MCAHab5I0WozQsmknY87Z1EPclMkc9A7Z2x:x42DMCA6b5fWQmknY87LEPcl9nlQ
TLSH
T113C47D2BB255E277D46308B25F9BA33B04799732A52D9502B3542E1FEB703E0A72435F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

25:d2:0b:8c:a0:33:fa:ec:77:99:ac:19:2f:4b:4f:54:6f:9a:a0:de

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Gutscheincodes.de Media GmbH,O=Gutscheincodes.de Media GmbH,POSTALCODE=10119,STREET=Schwedter Str. 263,L=Berlin,ST=Berlin,C=DE

Chains

Oct 7, 2026

CN=Gutscheincodes.de Media GmbH,O=Gutscheincodes.de Media GmbH,POSTALCODE=10119,STREET=Schwedter Str. 263,L=Berlin,ST=Berlin,C=DE

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

CN=Gutscheincodes.de Media GmbH,O=Gutscheincodes.de Media GmbH,POSTALCODE=10119,STREET=Schwedter Str. 263,L=Berlin,ST=Berlin,C=DE

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

CN=Gutscheincodes.de Media GmbH,O=Gutscheincodes.de Media GmbH,POSTALCODE=10119,STREET=Schwedter Str. 263,L=Berlin,ST=Berlin,C=DE

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Subject

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Serial Number

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 30, 2000 - May 30, 2020

Subject

CN=Gutscheincodes.de Media GmbH,O=Gutscheincodes.de Media GmbH,POSTALCODE=10119,STREET=Schwedter Str. 263,L=Berlin,ST=Berlin,C=DE

Serial Number

98:c0:bd:a2:14:5e:f3:94:e2:f9:72:64:3b:89:fc:46

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 24, 2019 - Jun 23, 2020

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Serial Number

13:ea:28:70:5b:f4:ec:ed:0c:36:63:09:80:61:43:36

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 30, 2000 - May 30, 2020

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 2, 2018 - Dec 31, 2030

Minor OS version

Major OS version

Entry point

85052

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

InitializeCriticalSectionAndSpinCount LocalAlloc LoadLibraryA CreateEventW WaitForSingleObject SetFilePointer SetFilePointerEx SetEndOfFile GetFileSize ReadFile GetFileAttributesExW GetCurrentProcessId GetTempFileNameW GetTickCount GetSystemTimeAsFileTime MapViewOfFile HeapFree FindClose GetFullPathNameW FindFirstFileW FindNextFileW DebugBreak OutputDebugStringW lstrlenA LoadLibraryW MulDiv lstrcmpW GlobalUnlock GlobalLock GlobalAlloc FlushFileBuffers CloseHandle CreateFileW WriteConsoleW SetStdHandle LCMapStringW GetConsoleMode GetConsoleCP DeleteCriticalSection RtlUnwind QueryPerformanceCounter GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetStringTypeW IsValidCodePage GetOEMCP GetACP GetCPInfo TlsFree TlsSetValue TlsGetValue TlsAlloc GetStdHandle WriteFile HeapReAlloc HeapCreate ExitProcess HeapSize Sleep IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess GetStartupInfoW HeapSetInformation GetCommandLineW DecodePointer EncodePointer InterlockedPopEntrySList VirtualAlloc VirtualFree IsProcessorFeaturePresent HeapAlloc GetProcessHeap InterlockedIncrement InterlockedDecrement lstrlenW GetModuleFileNameW LoadLibraryExW FindResourceW LoadResource SizeofResource MultiByteToWideChar lstrcmpiW FreeLibrary SetLastError GetLastError RaiseException GetCurrentThreadId FlushInstructionCache GetCurrentProcess GetModuleHandleW GetProcAddress LeaveCriticalSection EnterCriticalSection WideCharToMultiByte InterlockedPushEntrySList InterlockedCompareExchange

user32

DestroyWindow LoadCursorW CreateWindowExW RegisterClassExW SetTimer KillTimer DefWindowProcW GetWindowLongW GetClassInfoExW SetWindowLongW CallWindowProcW RegisterWindowMessageW BeginPaint FillRect EndPaint IsChild SetFocus GetDlgItem GetClassNameW GetSysColor RedrawWindow CreateAcceleratorTableW InvalidateRect GetDesktopWindow GetFocus UpdateWindow SetWindowTextW GetWindowTextW GetWindowTextLengthW ClientToScreen ReleaseDC GetDC PostMessageW ShowWindow IsWindowVisible GetWindow MonitorFromWindow GetMonitorInfoW GetParent GetClientRect MapWindowPoints SetWindowPos MoveWindow GetWindowRect IsWindow SendMessageW LoadImageW LoadIconW PeekMessageW GetMessageW TranslateMessage DispatchMessageW CharNextW UnregisterClassA

gdi32

CreateSolidBrush GetStockObject GetDeviceCaps GetObjectW SelectObject DeleteDC DeleteObject CreateCompatibleDC

comdlg32

GetSaveFileNameW GetOpenFileNameW

advapi32

RegQueryInfoKeyW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegSetValueExW RegQueryValueExW RegCreateKeyExW RegOpenKeyExW RegCloseKey

shell32

Shell_NotifyIconW CommandLineToArgvW DoEnvironmentSubstW

ole32

OleInitialize CreateStreamOnHGlobal OleLockRunning OleUninitialize CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree CoCreateInstance

oleaut32

SysAllocString VariantChangeType VariantClear OleCreateFontIndirect DispCallFunc VarBstrCat SysStringByteLen SysAllocStringByteLen LoadTypeLi LoadRegTypeLi VarUI4FromStr SysStringLen SysFreeString VariantInit VariantCopy

shlwapi

PathFileExistsW

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_not-a-virus.HEUR.Downloader.Win32.DownloaderGuide.gen.b7eba9efb7ff38839358f

PE Signature issue

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

generic