jaffacakes118_not-a-virus[.]HEUR[.]Monitor[.]Win32[.]Generic[.]4dd5d6e7bf2bee6b3b9a2436c288c7d5

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_not-a-virus.HEUR.Monitor.Win32.Generic.4dd5d6e7bf2bee6b3b9a2436c288c7d5
Size 760KB
Sample261014-fs5rssyycs
SHA256 0a8c8d433e62f030bdbc30bb057d0612166343df9c5c4ad2fe23fde29cecdb04
MD5 4dd5d6e7bf2bee6b3b9a2436c288c7d5
SHA1 4506d30312cac90034ec0b352f9eb1b7ddf8c831
SHA512 6a5c56364933ed9650ff740e39e8d9ad9e4d0861588bcb6d39af9ad2abba44435e648c75f3b1ab9a8e46d911750a6c2337d1307875fd9de2fa96abd735a35208
SSDEEP 12288:mX2P5VEl4bbXnrlfeuWBN3jDhGAgJB2fS:mX2slgb3cl3hNgJB
TLSH
T129F44B206F8FC07AC6A609761D3DEB5F247DB6844B7825C376D80BAE2DA04C12F36567
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_not-a-virus.HEUR.Monitor.Win32.Generic.4dd5d6e7bf2bee6b3b9a2436c288c7d5

File Explorer

jaffacakes118_not-a-virus.HEUR.Monitor.Win32.Generic.4dd5d6e7bf2bee6b3b9a2436c288c7d5

.dll 760KB

jaffacakes118_not-a-virus.HEUR.Monitor.Win32.Generic.4dd5d6e7bf2bee6b3b9a2436c288c7d5

IMPHASH 237597f52c9083e70937266b525fd7e5
SHA256 0a8c8d433e62f030bdbc30bb057d0612166343df9c5c4ad2fe23fde29cecdb04
MD5 4dd5d6e7bf2bee6b3b9a2436c288c7d5
SHA1 4506d30312cac90034ec0b352f9eb1b7ddf8c831
SHA512 6a5c56364933ed9650ff740e39e8d9ad9e4d0861588bcb6d39af9ad2abba44435e648c75f3b1ab9a8e46d911750a6c2337d1307875fd9de2fa96abd735a35208
SSDEEP 12288:mX2P5VEl4bbXnrlfeuWBN3jDhGAgJB2fS:mX2slgb3cl3hNgJB
TLSH
T129F44B206F8FC07AC6A609761D3DEB5F247DB6844B7825C376D80BAE2DA04C12F36567
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5119

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

rpcrt4

RpcBindingFree RpcStringBindingComposeA RpcBindingFromStringBindingA RpcStringFreeA NdrClientCall2

kernel32

WriteProcessMemory VirtualAllocEx CopyFileA OpenProcess GetSystemTime DuplicateHandle GetCurrentProcess OutputDebugStringA HeapAlloc HeapFree HeapCreate HeapDestroy GetTimeZoneInformation GetACP FormatMessageA FlushFileBuffers ReleaseMutex SetEndOfFile CreateMutexA TerminateThread GetWindowsDirectoryA GetPrivateProfileStructA GetPrivateProfileIntA WritePrivateProfileStringA WritePrivateProfileStructA UnmapViewOfFile MapViewOfFile CreateFileMappingA ResetEvent GetVolumeInformationA GetThreadPriority RemoveDirectoryA SetFileAttributesA GetProcessHeap GetShortPathNameA CreateRemoteThread FileTimeToDosDateTime SystemTimeToFileTime FindFirstFileA FindNextFileA SetEnvironmentVariableA CompareStringW CompareStringA SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetConsoleMode GetConsoleCP GetStartupInfoA GetFileType SetHandleCount GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA HeapSize HeapReAlloc VirtualAlloc VirtualFree ExitProcess GetStdHandle SetLastError TlsFree TlsSetValue TlsAlloc TlsGetValue IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter RaiseException CreateThread ExitThread GetSystemTimeAsFileTime RtlUnwind FindClose GetVersion GetLocalTime GetLocaleInfoA GetDateFormatA GetTimeFormatA LocalFree lstrlenA WideCharToMultiByte InterlockedDecrement GetCurrentProcessId DisableThreadLibraryCalls GetModuleFileNameA GetModuleHandleA GetSystemDirectoryA GetFileTime SetFileTime CreateDirectoryA DeleteFileA MoveFileA GetFileSize FileTimeToLocalFileTime FileTimeToSystemTime GetComputerNameA GetVersionExA GetLastError InitializeCriticalSection CreateEventA ResumeThread SetEvent InterlockedIncrement GetCurrentThreadId EnterCriticalSection LeaveCriticalSection WaitForSingleObject DeleteCriticalSection GetDiskFreeSpaceA Sleep LoadLibraryA GetProcAddress FreeLibrary GetTickCount MultiByteToWideChar WriteFile CreateFileA ReadFile SetFilePointer CloseHandle VirtualProtect TerminateProcess

user32

GetParent SetWindowPos GetWindowRect LoadKeyboardLayoutA ActivateKeyboardLayout UnloadKeyboardLayout CharLowerA GetKeyboardLayout MessageBoxA ExitWindowsEx GetDesktopWindow GetKeyNameTextA GetForegroundWindow GetKeyboardLayoutNameA SetTimer ToAsciiEx EndDialog SetForegroundWindow DispatchMessageA TranslateMessage IsWindow GetProcessWindowStation GetUserObjectInformationA UnregisterHotKey RegisterHotKey LoadCursorA BeginPaint EndPaint GetSystemMetrics MoveWindow LoadStringA GetWindowThreadProcessId SendMessageA SetDlgItemTextA EnumDisplaySettingsA KillTimer UnregisterClassA RegisterClassA CreateWindowExA GetWindowLongA DefWindowProcA SetWindowLongA GetCursorPos PostMessageA wsprintfA ShowWindow DialogBoxParamA GetPropA RemovePropA SetPropA DestroyWindow GetMessageA LoadIconA

gdi32

GetStockObject

advapi32

RegCreateKeyExA InitiateSystemShutdownA RegEnumValueA RegEnumKeyExA RegDeleteKeyA OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges LogonUserA DuplicateToken ImpersonateLoggedOnUser RevertToSelf OpenSCManagerA OpenServiceA CloseServiceHandle DeleteService RegOpenKeyExA RegDeleteValueA RegCloseKey RegQueryValueExA RegSetValueExA GetUserNameA

shell32

ShellExecuteA SHLoadInProc

ole32

CoTaskMemFree CoInitialize CoUninitialize StringFromCLSID CoCreateInstance

oleaut32

SysAllocString SysFreeString VariantInit VariantCopy VariantChangeType VariantClear

Name

.text

Size

476KB

Virtual Size

474KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

176KB

Virtual Size

175KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

60KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.shared

Size

8KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

32KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_not-a-virus.HEUR.Monitor.Win32.Generic.4dd5d6e7bf2bee6b3b9a2436c288c7d5

rpcrt4

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

generic