jaffacakes118_not-a-virus[.]HEUR[.]WebToolbar[.]Win32[.]SoftonicDownloader[.]gen[.]af7a46d5b8c0ade14c2ced8dbb8fcbfb

General

Target
jaffacakes118_not-a-virus.HEUR.WebToolbar.Win32.SoftonicDownloader.gen.af7a46d5b8c0ade14c2ced8dbb8fcbfb
Size 312KB
Sample261014-fx585af13w
SHA256 3dab79e5322d83e26a6086372acc04e37add10b71ddc679de3cc8f1d6f1162cf
MD5 af7a46d5b8c0ade14c2ced8dbb8fcbfb
SHA1 4c382211a4a2783253e7d95bbef7efecc0150a00
SHA512 fb348895b5f871aa866da64af1ec2aac4a51f06b1a187307637ec1750433b0b1b17d1a83ead9efd6b28b32b817bb59f828479d3fec9d866b44b789b2c363f84f
SSDEEP 6144:XnlEoWaZknVIaVaHl/c+gLzTwWlAdG+GhOYxfdUv2oSKlVO:XlEoWlnVIYIlTQzlCqi2oSKzO
TLSH
T1F2641277C3A11FD4CFD907F1586FDA10D0F0EBD285EC97416CEA219AAC86726362A607
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
jaffacakes118_not-a-virus.HEUR.WebToolbar.Win32.SoftonicDownloader.gen.af7a46d5b8c0ade14c2ced8dbb8fcbfb

File Explorer

jaffacakes118_not-a-virus.HEUR.WebToolbar.Win32.SoftonicDownloader.gen.af7a46d5b8c0ade14c2ced8dbb8fcbfb

.exe 312KB

jaffacakes118_not-a-virus.HEUR.WebToolbar.Win32.SoftonicDownloader.gen.af7a46d5b8c0ade14c2ced8dbb8fcbfb

SHA256 3dab79e5322d83e26a6086372acc04e37add10b71ddc679de3cc8f1d6f1162cf
MD5 af7a46d5b8c0ade14c2ced8dbb8fcbfb
SHA1 4c382211a4a2783253e7d95bbef7efecc0150a00
SHA512 fb348895b5f871aa866da64af1ec2aac4a51f06b1a187307637ec1750433b0b1b17d1a83ead9efd6b28b32b817bb59f828479d3fec9d866b44b789b2c363f84f
SSDEEP 6144:XnlEoWaZknVIaVaHl/c+gLzTwWlAdG+GhOYxfdUv2oSKlVO:XlEoWlnVIYIlTQzlCqi2oSKzO
TLSH
T1F2641277C3A11FD4CFD907F1586FDA10D0F0EBD285EC97416CEA219AAC86726362A607
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

33:ec:24:16:bd:c1:be:e3:51:48:af:3a:65:eb:bb:65

Digest Algorithm

md5

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Softonic International,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Softonic International,L=Barcelona,ST=Barcelona,C=ES

Chains

Jan 1, 0001

Subject

CN=Softonic International,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Softonic International,L=Barcelona,ST=Barcelona,C=ES

Serial Number

2a:56:cb:1b:38:93:46:b3:ed:08:ff:40:4a:77:1e:62

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 2, 2011 - Sep 6, 2013

Subject

Serial Number

18:da:d1:9e:26:7d:e8:bb:4a:21:58:cd:cc:6b:3b:4a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 8, 2006 - Jul 16, 2036

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

900512

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_not-a-virus.HEUR.WebToolbar.Win32.SoftonicDownloader.gen.af7a46d5b8c0ade14c2ced8dbb8fcbfb

PE Signature issue

generic