jaffacakes118_Trojan-FakeAV[.]Win32[.]Agent[.]iuuj[.]7ed20cd722805ca54618327b1967f2d0

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan-FakeAV.Win32.Agent.iuuj.7ed20cd722805ca54618327b1967f2d0
Size 45KB
Sample261014-lap7aafd75
SHA256 a1d3c6881a414c4d06bd5f0c4b07e719c632009f073a580e08f77f037ce05802
MD5 7ed20cd722805ca54618327b1967f2d0
SHA1 b1d23170e4a3560fc482a29abf107352431ee790
SHA512 593abcf80d4abac6bfa852322b76a544115ad86d8346badd32ea2a51fa599f80f30ce9662425869be716298d7454be282b6b4d582135de427f54d74918ef76ba
SSDEEP 768:cCNxU+Uh5ja9QI73wjbSpoo3e/HckrS2cr2qhSUYdJyR:FNxU+W+73uSpoo3e/8+dcr2ySU
TLSH
T1E3239F024B99847EFC7056B915D3A67E812A193A524FFD19F600ED124CEA193FDB9343
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan-FakeAV.Win32.Agent.iuuj.7ed20cd722805ca54618327b1967f2d0

File Explorer

jaffacakes118_Trojan-FakeAV.Win32.Agent.iuuj.7ed20cd722805ca54618327b1967f2d0

.exe 45KB

jaffacakes118_Trojan-FakeAV.Win32.Agent.iuuj.7ed20cd722805ca54618327b1967f2d0

IMPHASH 5afda5bec5ddd3ba31023406f0fca220
SHA256 a1d3c6881a414c4d06bd5f0c4b07e719c632009f073a580e08f77f037ce05802
MD5 7ed20cd722805ca54618327b1967f2d0
SHA1 b1d23170e4a3560fc482a29abf107352431ee790
SHA512 593abcf80d4abac6bfa852322b76a544115ad86d8346badd32ea2a51fa599f80f30ce9662425869be716298d7454be282b6b4d582135de427f54d74918ef76ba
SSDEEP 768:cCNxU+Uh5ja9QI73wjbSpoo3e/HckrS2cr2qhSUYdJyR:FNxU+W+73uSpoo3e/8+dcr2ySU
TLSH
T1E3239F024B99847EFC7056B915D3A67E812A193A524FFD19F600ED124CEA193FDB9343
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

42031

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

user32

EnumWindows GetWindowTextA GetWindowThreadProcessId CharUpperA MessageBoxA GetWindowTextLengthA

shell32

ShellExecuteA

dbghelp

MakeSureDirectoryPathExists

urlmon

URLDownloadToFileA

msvcrt

_controlfp _except_handler3 __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _acmdln exit _XcptFilter _exit fwrite srand rand strstr _splitpath atoi tolower fopen fclose strchr sprintf _strlwr _strrev _strupr

wininet

InternetGetConnectedState

wsock32

connect gethostbyname recv shutdown closesocket WSACleanup htons socket WSAStartup __WSAFDIsSet select WSAGetLastError inet_ntoa send

advapi32

RegCreateKeyA AdjustTokenPrivileges RegOpenKeyExA RegQueryValueExA GetUserNameA RegCloseKey LookupPrivilegeValueA OpenProcessToken RegSetValueExA

kernel32

WinExec GetCurrentThread SetThreadPriority ExitThread CreateThread Sleep GetVersionExA GetComputerNameA FreeLibrary LoadLibraryA GetProcAddress GetModuleFileNameA GetSystemDirectoryA GetWindowsDirectoryA GetTempPathA CreateSemaphoreA ReleaseSemaphore CreateEventA ExitProcess CreateMutexA GetLastError lstrlenA GetTickCount lstrcpyA GetCurrentProcess GetModuleHandleA GetCurrentProcessId CreateToolhelp32Snapshot Process32First OpenProcess TerminateProcess Process32Next GetSystemTime CreateProcessA WritePrivateProfileStringA CreateDirectoryA CreateFileA CloseHandle GlobalFree GlobalAlloc GetStartupInfoA SetFileAttributesA CopyFileA ReleaseMutex GetDriveTypeA