jaffacakes118_Trojan[.]Win32[.]Chapak[.]avir[.]16147ee6d1874fa001a3ffe52b3539e7

General

Target
jaffacakes118_Trojan.Win32.Chapak.avir.16147ee6d1874fa001a3ffe52b3539e7
Size 698KB
Sample261014-l697bsbt71
SHA256 3b2da41de7dd50a924ce58c544556fb616107dfb88e516088d19cf5eda0bf929
MD5 16147ee6d1874fa001a3ffe52b3539e7
SHA1 6f78588c1b4f5050f62959cb1d8c9f3667998acc
SHA512 2cc94d941a9f35865b603b2b6a109707104938f90a896b9fb247462c89c1c9c2ba8473fc11a2f2a0418394e27db41a7d7cd1ddab8ebe0d9c7b98602c4734d12a
SSDEEP 12288:6WBH8pkOnEer8VORFoaO3G9FNHrc65wRFgA0Ds2d5oGIihXA47Dmfhfm:6W98pkOnbrbFoa+kb2zEDs2wHilfDX
TLSH
T1D6E4026039C2C577D9661A3648B4DE7A572CEA200FA01DEB738C076E9FBC1D21A35D63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan.Win32.Chapak.avir.16147ee6d1874fa001a3ffe52b3539e7

File Explorer

jaffacakes118_Trojan.Win32.Chapak.avir.16147ee6d1874fa001a3ffe52b3539e7

.exe 698KB

jaffacakes118_Trojan.Win32.Chapak.avir.16147ee6d1874fa001a3ffe52b3539e7

IMPHASH 3bbc650127569b770485b117c5071502
SHA256 3b2da41de7dd50a924ce58c544556fb616107dfb88e516088d19cf5eda0bf929
MD5 16147ee6d1874fa001a3ffe52b3539e7
SHA1 6f78588c1b4f5050f62959cb1d8c9f3667998acc
SHA512 2cc94d941a9f35865b603b2b6a109707104938f90a896b9fb247462c89c1c9c2ba8473fc11a2f2a0418394e27db41a7d7cd1ddab8ebe0d9c7b98602c4734d12a
SSDEEP 12288:6WBH8pkOnEer8VORFoaO3G9FNHrc65wRFgA0Ds2d5oGIihXA47Dmfhfm:6W98pkOnbrbFoa+kb2zEDs2wHilfDX
TLSH
T1D6E4026039C2C577D9661A3648B4DE7A572CEA200FA01DEB738C076E9FBC1D21A35D63
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

50483

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetModuleHandleW GetLastError CreateIoCompletionPort DeleteCriticalSection InitializeCriticalSectionAndSpinCount CloseHandle VerifyVersionInfoW VerSetConditionMask WaitForSingleObject QueueUserAPC TerminateThread InterlockedExchangeAdd WaitForMultipleObjects InterlockedDecrement GetQueuedCompletionStatus SetWaitableTimer InterlockedExchange InterlockedIncrement PostQueuedCompletionStatus InterlockedCompareExchange SetLastError LeaveCriticalSection EnterCriticalSection TlsFree TlsAlloc TlsSetValue TlsGetValue SleepEx SetEvent CreateEventW LocalFree FormatMessageA DecodePointer WriteConsoleW SetFilePointerEx GetConsoleMode GetConsoleCP FlushFileBuffers HeapReAlloc HeapSize GetStringTypeW SetStdHandle GetFileType GetProcessHeap SetEnvironmentVariableA ResetEvent WaitForSingleObjectEx GetProcAddress UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead EncodePointer RaiseException RtlUnwind FreeLibrary LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetModuleFileNameA MultiByteToWideChar WideCharToMultiByte GetStdHandle WriteFile GetCommandLineA GetCommandLineW GetACP HeapFree HeapAlloc CompareStringW LCMapStringW FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW CreateFileW

ws2_32

WSARecv WSASocketW connect select getsockopt freeaddrinfo getaddrinfo WSASend setsockopt ioctlsocket WSASetLastError WSAGetLastError closesocket WSAStartup WSACleanup

Name

.text

Size

102KB

Virtual Size

101KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

36KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

300B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

546KB

Virtual Size

545KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_Trojan.Win32.Chapak.avir.16147ee6d1874fa001a3ffe52b3539e7

kernel32

ws2_32

generic