jaffacakes118_not-a-virus[.]HEUR[.]Downloader[.]Win32[.]DownloaderGuide[.]gen[.]ba28255f9b6e609b98557b00db0f1846

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_not-a-virus.HEUR.Downloader.Win32.DownloaderGuide.gen.ba28255f9b6e609b98557b00db0f1846
Size 547KB
Sample261014-flk4taee65
SHA256 18aa899d1c98145bc6593a45301fdacb22eb3a8e7fd93ac3ebb388b9f48a71f1
MD5 ba28255f9b6e609b98557b00db0f1846
SHA1 7d97e3a5f59cbf9e04849833b5f1243382828f29
SHA512 f8b9a5cae21318739172fcca4b1b49ffab8b7d0b064beb5e83a3e6f13b4cab81463c2ed3ad7bca6f840918e443825f84100fe219bc51f8b6610e1752c7bdff6f
SSDEEP 12288:oVjFbHu1F582816a2oyuuNC62uzEVf9JAWpNT7gdfT:WuR82812NTEVf9JAINWr
TLSH
T1B2C48D276155E1B6E1764CF2AADFA37240746F3054289113EBB42F3EAB726E1DC2131B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
jaffacakes118_not-a-virus.HEUR.Downloader.Win32.DownloaderGuide.gen.ba28255f9b6e609b98557b00db0f1846

File Explorer

jaffacakes118_not-a-virus.HEUR.Downloader.Win32.DownloaderGuide.gen.ba28255f9b6e609b98557b00db0f1846

.exe 547KB

jaffacakes118_not-a-virus.HEUR.Downloader.Win32.DownloaderGuide.gen.ba28255f9b6e609b98557b00db0f1846

IMPHASH 1e67d30fcd5f3dbaca5927aac127f144
SHA256 18aa899d1c98145bc6593a45301fdacb22eb3a8e7fd93ac3ebb388b9f48a71f1
MD5 ba28255f9b6e609b98557b00db0f1846
SHA1 7d97e3a5f59cbf9e04849833b5f1243382828f29
SHA512 f8b9a5cae21318739172fcca4b1b49ffab8b7d0b064beb5e83a3e6f13b4cab81463c2ed3ad7bca6f840918e443825f84100fe219bc51f8b6610e1752c7bdff6f
SSDEEP 12288:oVjFbHu1F582816a2oyuuNC62uzEVf9JAWpNT7gdfT:WuR82812NTEVf9JAINWr
TLSH
T1B2C48D276155E1B6E1764CF2AADFA37240746F3054289113EBB42F3EAB726E1DC2131B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

a0:20:45:ac:f7:71:a1:bc:e0:cc:2e:7e:2f:9e:3f:d1:3e:77:9a:de

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=freemium GmbH,O=freemium GmbH,POSTALCODE=10119,STREET=Schwedter Str. 9A,L=Berlin,ST=Berlin,C=DE

Chains

Oct 7, 2026

CN=freemium GmbH,O=freemium GmbH,POSTALCODE=10119,STREET=Schwedter Str. 9A,L=Berlin,ST=Berlin,C=DE

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

CN=freemium GmbH,O=freemium GmbH,POSTALCODE=10119,STREET=Schwedter Str. 9A,L=Berlin,ST=Berlin,C=DE

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

CN=freemium GmbH,O=freemium GmbH,POSTALCODE=10119,STREET=Schwedter Str. 9A,L=Berlin,ST=Berlin,C=DE

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Serial Number

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 30, 2000 - May 30, 2020

Subject

CN=freemium GmbH,O=freemium GmbH,POSTALCODE=10119,STREET=Schwedter Str. 9A,L=Berlin,ST=Berlin,C=DE

Serial Number

30:36:f2:c2:49:ee:56:b0:f3:65:b1:cd:ad:61:c8:bf

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 24, 2017 - May 24, 2018

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 30, 2000 - May 30, 2020

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 9, 2013 - May 8, 2028

Minor OS version

Major OS version

Entry point

81708

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

InterlockedDecrement InterlockedIncrement DeleteCriticalSection InitializeCriticalSectionAndSpinCount LocalAlloc LoadLibraryA CreateEventW WaitForSingleObject DeleteFileW SetFilePointerEx SetEndOfFile GetVersionExW GetFileSize GetTickCount ReleaseMutex CopyFileW MoveFileExW SystemTimeToFileTime Sleep CreateThread ResumeThread GetExitCodeProcess HeapFree FindClose GetFullPathNameW FindFirstFileW FindNextFileW DebugBreak OutputDebugStringW lstrlenA LoadLibraryW MulDiv lstrcmpW GlobalUnlock GlobalLock GlobalAlloc WideCharToMultiByte SetFilePointer RtlUnwind GetCurrentProcessId QueryPerformanceCounter GetFileType GetModuleFileNameW GetEnvironmentStringsW FreeEnvironmentStringsW GetStringTypeW IsValidCodePage GetOEMCP GetACP GetCPInfo TlsFree TlsSetValue TlsGetValue TlsAlloc GetStdHandle WriteFile HeapReAlloc HeapCreate ExitProcess HeapSize IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess GetStartupInfoW HeapSetInformation GetCommandLineW GetSystemTimeAsFileTime DecodePointer EncodePointer InterlockedPopEntrySList VirtualAlloc VirtualFree IsProcessorFeaturePresent HeapAlloc GetProcessHeap InterlockedPushEntrySList InterlockedCompareExchange GetConsoleMode LCMapStringW GetConsoleCP SetStdHandle WriteConsoleW ReadFile LoadLibraryExW FindResourceW LoadResource SizeofResource MultiByteToWideChar lstrcmpiW FreeLibrary GetLastError SetLastError RaiseException GetCurrentThreadId FlushInstructionCache GetCurrentProcess GetModuleHandleW GetProcAddress LeaveCriticalSection EnterCriticalSection SetHandleCount lstrlenW FlushFileBuffers CloseHandle CreateFileW

user32

GetSysColor GetClassNameW SetFocus IsChild EndPaint FillRect BeginPaint RegisterWindowMessageW RedrawWindow CreateAcceleratorTableW InvalidateRect GetFocus UpdateWindow GetWindowTextW GetWindowTextLengthW ClientToScreen ReleaseDC GetDC PostMessageW ShowWindow IsWindowVisible MonitorFromWindow GetMonitorInfoW GetParent GetClientRect MapWindowPoints SetWindowPos MoveWindow GetWindowRect IsWindow MsgWaitForMultipleObjects UpdateLayeredWindow GetWindow SendMessageW SetWindowTextW PostThreadMessageW MessageBoxW GetDesktopWindow PeekMessageW GetMessageW TranslateMessage DispatchMessageW CharNextW CallWindowProcW GetWindowLongW DefWindowProcW CreateWindowExW DestroyWindow LoadCursorW GetClassInfoExW RegisterClassExW SetTimer KillTimer SetWindowLongW GetDlgItem UnregisterClassA

gdi32

GetStockObject GetDeviceCaps GetObjectW SelectObject CreateCompatibleDC DeleteDC DeleteObject CreateSolidBrush

advapi32

RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegSetValueExW RegQueryValueExW RegCreateKeyExW RegOpenKeyExW RegCloseKey RegQueryInfoKeyW

ole32

OleInitialize CreateStreamOnHGlobal OleLockRunning OleUninitialize CoGetInterfaceAndReleaseStream CoMarshalInterThreadInterfaceInStream CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree CoCreateInstance

oleaut32

VariantCopy LoadRegTypeLi VarUI4FromStr OleCreateFontIndirect DispCallFunc VarBstrCat SysStringByteLen SysAllocStringByteLen SysFreeString VariantInit VariantClear VariantChangeType SysAllocString SysStringLen LoadTypeLi

shlwapi

PathFileExistsW

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_not-a-virus.HEUR.Downloader.Win32.DownloaderGuide.gen.ba28255f9b6e609b98557b00db0f1846

PE Signature issue

kernel32

user32

gdi32

advapi32

ole32

oleaut32

shlwapi

generic