jaffacakes118_not-a-virus[.]HEUR[.]Downloader[.]Win32[.]DownloaderGuide[.]gen[.]cff8450eba304f13873ef3586d11633b

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_not-a-virus.HEUR.Downloader.Win32.DownloaderGuide.gen.cff8450eba304f13873ef3586d11633b
Size 559KB
Sample261014-flpr1afy8v
SHA256 5e496689fdb2022129c6ed0b2b4ac23c22a7c1264f0a7fb80ef54fec0d547bce
MD5 cff8450eba304f13873ef3586d11633b
SHA1 40c0fd13463db59150a7a1b7b28dd02c83b5bfa9
SHA512 e7fb1a0042b901a6e269fb3f1b137173f1a4bd8048856797530fee296faf67de899d19aea479e258b6b7117efbefbea858d5b088bccb8de310984279d479c9f9
SSDEEP 12288:08WGC0twNEP9UsWf/N1YcseReA6k/9F3w:06wK9pWf//zseRB6kk
TLSH
T134C47D1667C6E5A6F1A24C71BE07B3724078A734A438D527B7886A0FBFA04F07151BE7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
jaffacakes118_not-a-virus.HEUR.Downloader.Win32.DownloaderGuide.gen.cff8450eba304f13873ef3586d11633b

File Explorer

jaffacakes118_not-a-virus.HEUR.Downloader.Win32.DownloaderGuide.gen.cff8450eba304f13873ef3586d11633b

.exe 559KB

jaffacakes118_not-a-virus.HEUR.Downloader.Win32.DownloaderGuide.gen.cff8450eba304f13873ef3586d11633b

IMPHASH b5723417ba5aaff89773ffe44d3747f5
SHA256 5e496689fdb2022129c6ed0b2b4ac23c22a7c1264f0a7fb80ef54fec0d547bce
MD5 cff8450eba304f13873ef3586d11633b
SHA1 40c0fd13463db59150a7a1b7b28dd02c83b5bfa9
SHA512 e7fb1a0042b901a6e269fb3f1b137173f1a4bd8048856797530fee296faf67de899d19aea479e258b6b7117efbefbea858d5b088bccb8de310984279d479c9f9
SSDEEP 12288:08WGC0twNEP9UsWf/N1YcseReA6k/9F3w:06wK9pWf//zseRB6kk
TLSH
T134C47D1667C6E5A6F1A24C71BE07B3724078A734A438D527B7886A0FBFA04F07151BE7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

d7:b7:33:f3:f0:84:cb:0d:26:55:b8:cb:cd:bd:94:d7:48:88:99:6b

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=freemium GmbH,O=freemium GmbH,POSTALCODE=10119,STREET=Schwedter Str. 9A,L=Berlin,ST=Berlin,C=DE

Chains

Oct 7, 2026

CN=freemium GmbH,O=freemium GmbH,POSTALCODE=10119,STREET=Schwedter Str. 9A,L=Berlin,ST=Berlin,C=DE

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

CN=freemium GmbH,O=freemium GmbH,POSTALCODE=10119,STREET=Schwedter Str. 9A,L=Berlin,ST=Berlin,C=DE

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

CN=freemium GmbH,O=freemium GmbH,POSTALCODE=10119,STREET=Schwedter Str. 9A,L=Berlin,ST=Berlin,C=DE

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Serial Number

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 30, 2000 - May 30, 2020

Subject

CN=freemium GmbH,O=freemium GmbH,POSTALCODE=10119,STREET=Schwedter Str. 9A,L=Berlin,ST=Berlin,C=DE

Serial Number

30:36:f2:c2:49:ee:56:b0:f3:65:b1:cd:ad:61:c8:bf

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 24, 2017 - May 24, 2018

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 30, 2000 - May 30, 2020

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 9, 2013 - May 8, 2028

Minor OS version

Major OS version

Entry point

87052

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

InterlockedIncrement DeleteCriticalSection InitializeCriticalSectionAndSpinCount LocalAlloc LoadLibraryA CloseHandle ResetEvent GetSystemTime ReleaseMutex MoveFileExW SetCurrentDirectoryW CreateFileMappingW FindClose GetFullPathNameW FindFirstFileW FindNextFileW DebugBreak OutputDebugStringW lstrlenA LoadLibraryW MulDiv lstrcmpW GlobalUnlock GlobalLock GlobalAlloc FlushFileBuffers CreateFileW ReadFile WriteConsoleW SetStdHandle LCMapStringW GetConsoleMode GetConsoleCP WideCharToMultiByte SetFilePointer InterlockedDecrement RtlUnwind GetCurrentProcessId GetTickCount QueryPerformanceCounter GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetStringTypeW IsValidCodePage GetOEMCP GetACP GetCPInfo TlsFree TlsSetValue TlsGetValue TlsAlloc GetStdHandle WriteFile HeapReAlloc HeapCreate ExitProcess HeapSize Sleep IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess GetStartupInfoW HeapSetInformation GetCommandLineW GetSystemTimeAsFileTime DecodePointer EncodePointer InterlockedPopEntrySList GetModuleFileNameW LoadLibraryExW FindResourceW LoadResource SizeofResource lstrlenW MultiByteToWideChar lstrcmpiW FreeLibrary SetLastError GetLastError RaiseException GetCurrentThreadId FlushInstructionCache GetCurrentProcess GetModuleHandleW GetProcAddress LeaveCriticalSection EnterCriticalSection VirtualAlloc VirtualFree IsProcessorFeaturePresent HeapAlloc GetProcessHeap HeapFree InterlockedPushEntrySList InterlockedCompareExchange

user32

GetFocus SetWindowLongW KillTimer SetTimer RegisterClassExW GetClassInfoExW LoadCursorW DestroyWindow CreateWindowExW RegisterWindowMessageW BeginPaint FillRect EndPaint IsChild SetFocus GetDlgItem GetClassNameW GetSysColor RedrawWindow CreateAcceleratorTableW InvalidateRect GetDesktopWindow UnregisterClassA UpdateWindow SetWindowTextW GetWindowTextW GetWindowTextLengthW SendMessageW ClientToScreen ReleaseDC GetDC PostMessageW ShowWindow IsWindowVisible GetWindow MonitorFromWindow GetMonitorInfoW GetParent GetClientRect MapWindowPoints SetWindowPos MoveWindow GetWindowRect IsWindow MessageBoxW PeekMessageW GetMessageW TranslateMessage DispatchMessageW CharNextW CallWindowProcW GetWindowLongW DefWindowProcW

gdi32

CreateSolidBrush GetStockObject GetObjectW SelectObject CreateCompatibleDC DeleteDC DeleteObject GetDeviceCaps

advapi32

RegQueryInfoKeyW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegSetValueExW RegQueryValueExW RegCreateKeyExW RegOpenKeyExW RegCloseKey

ole32

CoCreateInstance CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc OleUninitialize OleLockRunning CreateStreamOnHGlobal OleInitialize

oleaut32

LoadTypeLi SysFreeString VariantInit VariantClear VariantChangeType SysAllocString VariantCopy SysStringLen VarUI4FromStr LoadRegTypeLi OleCreateFontIndirect SysAllocStringByteLen SysStringByteLen VarBstrCat DispCallFunc

shlwapi

PathAddBackslashW PathFileExistsW

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_not-a-virus.HEUR.Downloader.Win32.DownloaderGuide.gen.cff8450eba304f13873ef3586d11633b

PE Signature issue

kernel32

user32

gdi32

advapi32

ole32

oleaut32

shlwapi

generic