jaffacakes118_not-a-virus[.]HEUR[.]Downloader[.]Win32[.]DownloaderGuide[.]gen[.]e4158e843e989b1174c43

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_not-a-virus.HEUR.Downloader.Win32.DownloaderGuide.gen.e4158e843e989b1174c43
Size 547KB
Sample261014-fml3hagv2n
SHA256 b1593d807f9b56361d2525333e822e6bab1d91d1ae6cdeb3b7c53e5d8eb1d6bb
MD5 d2ed3a9a6c1e4158e843e989b1174c43
SHA1 e37499a859bd88aaa92294017108ab5bb8b126ca
SHA512 4aeec2693a985faa7d15858a78b4c82573a964f684136d519370f8f7fd718d26448612efecd43c5dee5d3190f82aaa8bc93dc6eb8fbab7646afcb7c73d93fa70
SSDEEP 12288:Q4fmuV/2SlI1MCAHab5I0WozQsmknY87Z1EPclMkc9A7Z2B:Q42DMCA6b5fWQmknY87LEPcl9nlU
TLSH
T1A0C47D2BB295E277D46308B25E9BA33704799732A52DD502B3542E1FEB703E0A72435F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
jaffacakes118_not-a-virus.HEUR.Downloader.Win32.DownloaderGuide.gen.e4158e843e989b1174c43

File Explorer

jaffacakes118_not-a-virus.HEUR.Downloader.Win32.DownloaderGuide.gen.e4158e843e989b1174c43

.exe 547KB

jaffacakes118_not-a-virus.HEUR.Downloader.Win32.DownloaderGuide.gen.e4158e843e989b1174c43

IMPHASH 24f4613d0395ec689682abd0a1f8a028
SHA256 b1593d807f9b56361d2525333e822e6bab1d91d1ae6cdeb3b7c53e5d8eb1d6bb
MD5 d2ed3a9a6c1e4158e843e989b1174c43
SHA1 e37499a859bd88aaa92294017108ab5bb8b126ca
SHA512 4aeec2693a985faa7d15858a78b4c82573a964f684136d519370f8f7fd718d26448612efecd43c5dee5d3190f82aaa8bc93dc6eb8fbab7646afcb7c73d93fa70
SSDEEP 12288:Q4fmuV/2SlI1MCAHab5I0WozQsmknY87Z1EPclMkc9A7Z2B:Q42DMCA6b5fWQmknY87LEPcl9nlU
TLSH
T1A0C47D2BB295E277D46308B25E9BA33704799732A52DD502B3542E1FEB703E0A72435F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

8d:84:60:25:2e:97:0e:90:c4:ab:44:31:ae:df:35:9c:d7:16:99:58

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Gutscheincodes.de Media GmbH,O=Gutscheincodes.de Media GmbH,POSTALCODE=10119,STREET=Schwedter Str. 263,L=Berlin,ST=Berlin,C=DE

Chains

Oct 7, 2026

CN=Gutscheincodes.de Media GmbH,O=Gutscheincodes.de Media GmbH,POSTALCODE=10119,STREET=Schwedter Str. 263,L=Berlin,ST=Berlin,C=DE

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

CN=Gutscheincodes.de Media GmbH,O=Gutscheincodes.de Media GmbH,POSTALCODE=10119,STREET=Schwedter Str. 263,L=Berlin,ST=Berlin,C=DE

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

CN=Gutscheincodes.de Media GmbH,O=Gutscheincodes.de Media GmbH,POSTALCODE=10119,STREET=Schwedter Str. 263,L=Berlin,ST=Berlin,C=DE

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Subject

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Serial Number

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 30, 2000 - May 30, 2020

Subject

CN=Gutscheincodes.de Media GmbH,O=Gutscheincodes.de Media GmbH,POSTALCODE=10119,STREET=Schwedter Str. 263,L=Berlin,ST=Berlin,C=DE

Serial Number

98:c0:bd:a2:14:5e:f3:94:e2:f9:72:64:3b:89:fc:46

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 24, 2019 - Jun 23, 2020

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Serial Number

13:ea:28:70:5b:f4:ec:ed:0c:36:63:09:80:61:43:36

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 30, 2000 - May 30, 2020

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 2, 2018 - Dec 31, 2030

Minor OS version

Major OS version

Entry point

85052

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

InitializeCriticalSectionAndSpinCount LocalAlloc LoadLibraryA CreateEventW WaitForSingleObject SetFilePointer SetFilePointerEx SetEndOfFile GetFileSize ReadFile GetFileAttributesExW GetCurrentProcessId GetTempFileNameW GetTickCount GetSystemTimeAsFileTime MapViewOfFile HeapFree FindClose GetFullPathNameW FindFirstFileW FindNextFileW DebugBreak OutputDebugStringW lstrlenA LoadLibraryW MulDiv lstrcmpW GlobalUnlock GlobalLock GlobalAlloc FlushFileBuffers CloseHandle CreateFileW WriteConsoleW SetStdHandle LCMapStringW GetConsoleMode GetConsoleCP DeleteCriticalSection RtlUnwind QueryPerformanceCounter GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetStringTypeW IsValidCodePage GetOEMCP GetACP GetCPInfo TlsFree TlsSetValue TlsGetValue TlsAlloc GetStdHandle WriteFile HeapReAlloc HeapCreate ExitProcess HeapSize Sleep IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess GetStartupInfoW HeapSetInformation GetCommandLineW DecodePointer EncodePointer InterlockedPopEntrySList VirtualAlloc VirtualFree IsProcessorFeaturePresent HeapAlloc GetProcessHeap InterlockedIncrement InterlockedDecrement lstrlenW GetModuleFileNameW LoadLibraryExW FindResourceW LoadResource SizeofResource MultiByteToWideChar lstrcmpiW FreeLibrary SetLastError GetLastError RaiseException GetCurrentThreadId FlushInstructionCache GetCurrentProcess GetModuleHandleW GetProcAddress LeaveCriticalSection EnterCriticalSection WideCharToMultiByte InterlockedPushEntrySList InterlockedCompareExchange

user32

DestroyWindow LoadCursorW CreateWindowExW RegisterClassExW SetTimer KillTimer DefWindowProcW GetWindowLongW GetClassInfoExW SetWindowLongW CallWindowProcW RegisterWindowMessageW BeginPaint FillRect EndPaint IsChild SetFocus GetDlgItem GetClassNameW GetSysColor RedrawWindow CreateAcceleratorTableW InvalidateRect GetDesktopWindow GetFocus UpdateWindow SetWindowTextW GetWindowTextW GetWindowTextLengthW ClientToScreen ReleaseDC GetDC PostMessageW ShowWindow IsWindowVisible GetWindow MonitorFromWindow GetMonitorInfoW GetParent GetClientRect MapWindowPoints SetWindowPos MoveWindow GetWindowRect IsWindow SendMessageW LoadImageW LoadIconW PeekMessageW GetMessageW TranslateMessage DispatchMessageW CharNextW UnregisterClassA

gdi32

CreateSolidBrush GetStockObject GetDeviceCaps GetObjectW SelectObject DeleteDC DeleteObject CreateCompatibleDC

comdlg32

GetSaveFileNameW GetOpenFileNameW

advapi32

RegQueryInfoKeyW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegSetValueExW RegQueryValueExW RegCreateKeyExW RegOpenKeyExW RegCloseKey

shell32

Shell_NotifyIconW CommandLineToArgvW DoEnvironmentSubstW

ole32

OleInitialize CreateStreamOnHGlobal OleLockRunning OleUninitialize CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree CoCreateInstance

oleaut32

SysAllocString VariantChangeType VariantClear OleCreateFontIndirect DispCallFunc VarBstrCat SysStringByteLen SysAllocStringByteLen LoadTypeLi LoadRegTypeLi VarUI4FromStr SysStringLen SysFreeString VariantInit VariantCopy

shlwapi

PathFileExistsW

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_not-a-virus.HEUR.Downloader.Win32.DownloaderGuide.gen.e4158e843e989b1174c43

PE Signature issue

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

generic