jaffacakes118_not-a-virus[.]HEUR[.]Downloader[.]Win32[.]DownloaderGuide[.]gen[.]cf6d743192d99746239ac46df06df37a

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_not-a-virus.HEUR.Downloader.Win32.DownloaderGuide.gen.cf6d743192d99746239ac46df06df37a
Size 513KB
Sample261014-flmyeaee67
SHA256 cae3e4557995ca58cfb91eb487460fdc9c47de58503496609ca5478400914832
MD5 cf6d743192d99746239ac46df06df37a
SHA1 514578892586ba61b8660d28195373bbf2924363
SHA512 cb9adc98163ea0fd8090f83aba3ffd328dc5e769e79ec66a5ef0b2c1873c5b720fde44a902f765425367802d0735c734b41040c41649e9dc5dc8547bcb4045eb
SSDEEP 12288:xKpfGK+ky0BX/mAEb4n005cSYMFjp13tm0WnM52Z914u7ewE:xy+CX/mAEbA92SYMFdZtm0WnM5w9x7eL
TLSH
T1FEB49D2A6656E176C17E0CB15F0AA3F974B8B6707E98B823F3940F1D5AB35E3911060F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
jaffacakes118_not-a-virus.HEUR.Downloader.Win32.DownloaderGuide.gen.cf6d743192d99746239ac46df06df37a

File Explorer

jaffacakes118_not-a-virus.HEUR.Downloader.Win32.DownloaderGuide.gen.cf6d743192d99746239ac46df06df37a

.exe 513KB

jaffacakes118_not-a-virus.HEUR.Downloader.Win32.DownloaderGuide.gen.cf6d743192d99746239ac46df06df37a

IMPHASH b0e2c535eb7b96535aa1f785be9b9044
SHA256 cae3e4557995ca58cfb91eb487460fdc9c47de58503496609ca5478400914832
MD5 cf6d743192d99746239ac46df06df37a
SHA1 514578892586ba61b8660d28195373bbf2924363
SHA512 cb9adc98163ea0fd8090f83aba3ffd328dc5e769e79ec66a5ef0b2c1873c5b720fde44a902f765425367802d0735c734b41040c41649e9dc5dc8547bcb4045eb
SSDEEP 12288:xKpfGK+ky0BX/mAEb4n005cSYMFjp13tm0WnM52Z914u7ewE:xy+CX/mAEbA92SYMFdZtm0WnM5w9x7eL
TLSH
T1FEB49D2A6656E176C17E0CB15F0AA3F974B8B6707E98B823F3940F1D5AB35E3911060F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

b1:52:64:c0:db:3e:75:51:f2:6f:58:b5:8b:c6:9d:49:ac:19:30:32

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=freemium GmbH,O=freemium GmbH,POSTALCODE=10119,STREET=Schwedter Str. 9A,L=Berlin,ST=Berlin,C=DE

Chains

Oct 7, 2026

CN=freemium GmbH,O=freemium GmbH,POSTALCODE=10119,STREET=Schwedter Str. 9A,L=Berlin,ST=Berlin,C=DE

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

CN=freemium GmbH,O=freemium GmbH,POSTALCODE=10119,STREET=Schwedter Str. 9A,L=Berlin,ST=Berlin,C=DE

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

CN=freemium GmbH,O=freemium GmbH,POSTALCODE=10119,STREET=Schwedter Str. 9A,L=Berlin,ST=Berlin,C=DE

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Serial Number

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 30, 2000 - May 30, 2020

Subject

CN=freemium GmbH,O=freemium GmbH,POSTALCODE=10119,STREET=Schwedter Str. 9A,L=Berlin,ST=Berlin,C=DE

Serial Number

30:36:f2:c2:49:ee:56:b0:f3:65:b1:cd:ad:61:c8:bf

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 24, 2017 - May 24, 2018

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 30, 2000 - May 30, 2020

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 9, 2013 - May 8, 2028

Minor OS version

Major OS version

Entry point

79692

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

InterlockedIncrement DeleteCriticalSection InitializeCriticalSectionAndSpinCount LocalAlloc LoadLibraryA DeleteFileW CreateFileW SetFilePointer SetFilePointerEx GetTempPathW ReadFile RemoveDirectoryW GetCurrentProcessId MoveFileExW GetLocaleInfoW GlobalAlloc GetProcessHeap lstrcmpW FindClose GetFullPathNameW FindFirstFileW FindNextFileW DebugBreak OutputDebugStringW lstrlenA LoadLibraryW MulDiv GlobalUnlock GlobalLock FlushFileBuffers CloseHandle WriteConsoleW SetStdHandle LCMapStringW GetConsoleMode GetConsoleCP InterlockedDecrement RtlUnwind GetTickCount QueryPerformanceCounter GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetStringTypeW IsValidCodePage GetOEMCP GetACP GetCPInfo TlsFree TlsSetValue TlsGetValue TlsAlloc GetStdHandle WriteFile HeapReAlloc HeapCreate ExitProcess HeapSize Sleep IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess GetStartupInfoW HeapSetInformation GetCommandLineW GetSystemTimeAsFileTime DecodePointer EncodePointer InterlockedPopEntrySList VirtualAlloc VirtualFree IsProcessorFeaturePresent HeapAlloc HeapFree GetModuleFileNameW LoadLibraryExW FindResourceW lstrlenW LoadResource SizeofResource MultiByteToWideChar lstrcmpiW FreeLibrary SetLastError GetLastError RaiseException GetCurrentThreadId FlushInstructionCache GetCurrentProcess GetModuleHandleW GetProcAddress LeaveCriticalSection EnterCriticalSection WideCharToMultiByte InterlockedPushEntrySList InterlockedCompareExchange

user32

DefWindowProcW CreateWindowExW DestroyWindow GetWindowLongW GetClassInfoExW RegisterClassExW SetTimer KillTimer CallWindowProcW CharNextW LoadCursorW SetWindowLongW DispatchMessageW RegisterWindowMessageW BeginPaint FillRect EndPaint IsChild SetFocus GetDlgItem GetClassNameW GetSysColor RedrawWindow CreateAcceleratorTableW InvalidateRect GetDesktopWindow GetFocus UpdateWindow GetWindowTextW GetWindowTextLengthW ClientToScreen ReleaseDC GetDC PostMessageW ShowWindow IsWindowVisible GetWindow MonitorFromWindow GetMonitorInfoW GetClientRect MapWindowPoints SetWindowPos MoveWindow GetWindowRect IsWindow MsgWaitForMultipleObjects GetParent SendMessageW SetWindowTextW PeekMessageW GetMessageW TranslateMessage UnregisterClassA

gdi32

CreateSolidBrush GetStockObject GetDeviceCaps GetObjectW CreateCompatibleDC DeleteDC DeleteObject SelectObject

advapi32

RegQueryInfoKeyW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegSetValueExW RegQueryValueExW RegCreateKeyExW RegOpenKeyExW RegCloseKey

shell32

Shell_NotifyIconW DoEnvironmentSubstW

ole32

OleInitialize CreateStreamOnHGlobal OleLockRunning OleUninitialize CoGetInterfaceAndReleaseStream CoMarshalInterThreadInterfaceInStream CLSIDFromString CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree CoCreateInstance

oleaut32

VariantChangeType VariantInit OleCreateFontIndirect DispCallFunc VarBstrCat SysStringByteLen SysAllocStringByteLen LoadTypeLi LoadRegTypeLi VarUI4FromStr SysStringLen VariantCopy SysAllocString SysFreeString VariantClear

shlwapi

PathFileExistsW

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_not-a-virus.HEUR.Downloader.Win32.DownloaderGuide.gen.cf6d743192d99746239ac46df06df37a

PE Signature issue

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

generic