jaffacakes118_HEUR[.]Trojan[.]Win32[.]Generic[.]6e6ba16699c404300fcb0

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.6e6ba16699c404300fcb0
Size 646KB
Sample261014-hszlwsfa68
SHA256 0ec0bd5e1fa273ffa462be2ef98ab231113689095a231697ad3a214597f86655
MD5 d87021af0c86e6ba16699c404300fcb0
SHA1 4165fd587489056d1628a6b9181444d01c168df8
SHA512 51f90c389b97daf03d0059565f42798b9b9d82efa501c7cd1356b48837ef35dae8cc5ee57629970c785b9c719d518e4819ed41071ca8855de42a7074950fdd28
SSDEEP 12288:YiCK7kCyjO7ThYChGf+oHWB0EhIMCixA5Jb8MSQQ2iXpNh:9kjO7Ta2o2BV+iW77SQ4XpNh
TLSH
T159E4DF0AB501A19DE328CD34F235DAD5D3AA7ED74122958E278D39DAF53BBC09309D0E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_HEUR.Trojan.Win32.Generic.6e6ba16699c404300fcb0

File Explorer

jaffacakes118_HEUR.Trojan.Win32.Generic.6e6ba16699c404300fcb0

.exe 646KB

jaffacakes118_HEUR.Trojan.Win32.Generic.6e6ba16699c404300fcb0

IMPHASH 7a49817886d8d03e2f698d610bf8bac2
SHA256 0ec0bd5e1fa273ffa462be2ef98ab231113689095a231697ad3a214597f86655
MD5 d87021af0c86e6ba16699c404300fcb0
SHA1 4165fd587489056d1628a6b9181444d01c168df8
SHA512 51f90c389b97daf03d0059565f42798b9b9d82efa501c7cd1356b48837ef35dae8cc5ee57629970c785b9c719d518e4819ed41071ca8855de42a7074950fdd28
SSDEEP 12288:YiCK7kCyjO7ThYChGf+oHWB0EhIMCixA5Jb8MSQQ2iXpNh:9kjO7Ta2o2BV+iW77SQ4XpNh
TLSH
T159E4DF0AB501A19DE328CD34F235DAD5D3AA7ED74122958E278D39DAF53BBC09309D0E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

14621

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

D:\k6j\3z7xiwu\r7e6\w831yzp\g0e03d\mm\qcpbqsh3\boymm\tg5qu\jdjpbwoh9.pdb

kernel32

LoadLibraryA FindResourceW SetStdHandle GetConsoleCP InterlockedIncrement LockResource DeleteCriticalSection CreateFileA GetModuleHandleW TerminateProcess VirtualFree GetStartupInfoA VirtualAlloc IsValidCodePage TlsAlloc GetACP SizeofResource ReadFile IsDebuggerPresent GetModuleFileNameW SetHandleCount SetFileTime FlushFileBuffers SetUnhandledExceptionFilter GetUserDefaultUILanguage GetLocaleInfoA Sleep RaiseException HeapReAlloc FlushInstructionCache GetOEMCP InterlockedDecrement GetConsoleMode InitializeCriticalSectionAndSpinCount FindResourceExW HeapSize GetModuleFileNameA EnterCriticalSection LoadResource DeleteFileW InterlockedCompareExchange GetProcAddress MultiByteToWideChar ExitProcess GetFileAttributesW WriteConsoleW LeaveCriticalSection GetLocaleInfoW LCMapStringA CreateMutexW SetFilePointer GetProcessHeap GetSystemTimeAsFileTime FindClose ReleaseMutex CreateProcessW SetCurrentDirectoryW GetExitCodeProcess FindFirstFileW WaitForSingleObject GetCurrentDirectoryW GetDriveTypeW GlobalAddAtomA VirtualProtectEx AddAtomW lstrcmpiW GetCommandLineW HeapCreate SetEndOfFile GetTickCount GetStringTypeW LoadLibraryExW CreateFileW LCMapStringW lstrlenW UnhandledExceptionFilter GetCurrentThreadId FreeLibrary CreateThread GetStartupInfoW GetCurrentProcess QueryPerformanceCounter FormatMessageW GetStringTypeA GetLastError EnumResourceLanguagesW GetStdHandle FreeEnvironmentStringsW WriteConsoleA TlsGetValue SetLastError WideCharToMultiByte GetCPInfo TlsSetValue GetVersion GetConsoleOutputCP CloseHandle GetFileType TlsFree HeapFree GetEnvironmentVariableW WriteFile HeapAlloc GetCurrentProcessId GetFileAttributesExW EnumResourceNamesW GetExitCodeThread InitializeCriticalSection IsProcessorFeaturePresent RtlUnwind GetEnvironmentStringsW HeapDestroy GetModuleHandleA ExpandEnvironmentStringsA

user32

IsWindow SetWindowsHookExW RegisterWindowMessageW FindWindowExW PostQuitMessage SetWindowLongW UnhookWindowsHookEx GetWindowThreadProcessId wsprintfW SendMessageA CreateWindowExW AllowSetForegroundWindow FindWindowW GetDlgItem MessageBoxW DestroyWindow GetDlgItemTextW GetMessagePos TrackPopupMenuEx GetMenuItemID SendDlgItemMessageW RegisterClassExW AppendMenuW GetParent GetWindowTextW DrawIconEx GetDesktopWindow MapWindowPoints OffsetRect GetSysColorBrush IsDlgButtonChecked PeekMessageW EnableMenuItem SetTimer GetFocus GetWindowTextLengthW TrackPopupMenu EnableWindow PostMessageW GetSystemMenu SetWindowTextW CheckMenuItem LoadCursorW DispatchMessageW ScreenToClient TranslateMessage ClientToScreen MapVirtualKeyW DestroyIcon IsChild FillRect GetAncestor InsertMenuW DefWindowProcW CallWindowProcW PtInRect SetDlgItemTextW GetThreadDesktop ShowWindow CharUpperW CreatePopupMenu IsWindowVisible GetKeyState GetClassInfoExW CheckDlgButton MonitorFromWindow CreateDialogIndirectParamW GetKeyNameTextW LoadIconW GetMessageW GetMenuItemCount GetWindowLongW GetSysColor UnregisterClassA IsDialogMessageW GetUserObjectInformationW GetMonitorInfoW SetFocus DrawFrameControl DestroyMenu

gdi32

DeleteDC SetTextColor GetTextExtentPointW CreateFontW DeleteObject SetBkMode SetDCBrushColor GetTextMetricsW CreateDIBSection Rectangle CreateCompatibleDC SelectObject GetDeviceCaps GetStockObject SetDCPenColor

comdlg32

GetOpenFileNameW ChooseFontW ChooseColorW GetSaveFileNameW

advapi32

RegOpenKeyExW RegDeleteValueW RegOpenKeyExA GetUserNameW RegCloseKey RegQueryValueExA RegQueryValueExW RegSetValueExW RegCreateKeyExW

shell32

SHEmptyRecycleBinW ShellExecuteExW ShellExecuteW DoEnvironmentSubstW SHAppBarMessage

ole32

CoInitialize OleUninitialize OleInitialize CoTaskMemFree CoUninitialize CLSIDFromProgID CoCreateInstance

oleaut32

VarCmp VariantInit SysAllocString VariantCopy SysFreeString VariantClear SysAllocStringLen SysStringLen

comctl32

ImageList_GetIconSize ImageList_SetOverlayImage ImageList_Add ImageList_Remove ImageList_ReplaceIcon ImageList_Create ImageList_Destroy InitCommonControlsEx ImageList_Replace

shlwapi

SHAutoComplete PathAppendW PathRemoveFileSpecW PathFindExtensionW PathFindFileNameW PathAddExtensionW

winmm

timeGetTime PlaySoundW

crypt32

CertCloseStore CertFindCertificateInStore CryptQueryObject CryptMsgClose CryptMsgGetParam CertGetNameStringW

wininet

InternetCrackUrlW InternetConnectW InternetQueryOptionW InternetCloseHandle HttpOpenRequestW InternetOpenW HttpSendRequestW InternetReadFile HttpQueryInfoW

msvcrt

free isalpha atol __set_app_type exit isspace fopen calloc

wintrust

WinVerifyTrust

uxtheme

DrawThemeBackground OpenThemeData CloseThemeData GetThemePartSize IsAppThemed SetWindowTheme EnableThemeDialogTexture