jaffacakes118_Trojan[.]Win32[.]Snojan[.]boiy[.]985f111df05d1fc75b53633d651f2b61

General

Target
jaffacakes118_Trojan.Win32.Snojan.boiy.985f111df05d1fc75b53633d651f2b61
Size 1.2MB
Sample261014-mlvrksff53
SHA256 09cc50153b24ae8a9b841aeea6c9c39fd252708ed1b357333fd45af0846c6960
MD5 985f111df05d1fc75b53633d651f2b61
SHA1 d4e71ceec276e18597a4d070c09eeb56ec6084e0
SHA512 6e918107eba6332d1464ba2d70fd69a9aafe2b1be4d16e37f37c334489b71f0d99fbb45365d86cca6e3239a70906e219539692f0a64c222ee98f71a181c192f3
SSDEEP 24576:MY9UEMx2jZTKKlgbFYMXZbj9gZVbo2KyMLHjxRJfBpUKrly0eBf8:EEMxYZTKKlSgoQQNzfBGKJy06
TLSH
T1BB45CF82FAD3C1F1FE9531BD42BA5A7B0D396A055326C4D7AA941D80CE711E2763F382
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan.Win32.Snojan.boiy.985f111df05d1fc75b53633d651f2b61
unpack001/system.data.sqlite.dll
unpack001/system.data.sqlite.linq.dll

File Explorer

jaffacakes118_Trojan.Win32.Snojan.boiy.985f111df05d1fc75b53633d651f2b61

.exe 1.2MB
system.data.sqlite.dll

.dll 324KB
system.data.sqlite.linq.dll

.dll 192KB

jaffacakes118_Trojan.Win32.Snojan.boiy.985f111df05d1fc75b53633d651f2b61

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 09cc50153b24ae8a9b841aeea6c9c39fd252708ed1b357333fd45af0846c6960
MD5 985f111df05d1fc75b53633d651f2b61
SHA1 d4e71ceec276e18597a4d070c09eeb56ec6084e0
SHA512 6e918107eba6332d1464ba2d70fd69a9aafe2b1be4d16e37f37c334489b71f0d99fbb45365d86cca6e3239a70906e219539692f0a64c222ee98f71a181c192f3
SSDEEP 24576:MY9UEMx2jZTKKlgbFYMXZbj9gZVbo2KyMLHjxRJfBpUKrly0eBf8:EEMxYZTKKlSgoQQNzfBGKJy06
TLSH
T1BB45CF82FAD3C1F1FE9531BD42BA5A7B0D396A055326C4D7AA941D80CE711E2763F382
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

1249390

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\BABLIK\Documents\Visual Studio 2017\Projects\WindowsFormsApp12\WindowsFormsApp12\obj\Release\system_lm.pdb

system.data.sqlite.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d44f9ddd0362306bc059d3cf8a9691eb219e26296ec4ad2f5f5f58ad10f77ca7
MD5 09e1d3884873594523eeff74d5e329d4
SHA1 4551ed1d3cdb2dfa2169d1934fb7d180811102c4
SHA512 2afff744a34d7f1844903dfc70f64111b5766f06402b9f68ae55fec3bc73e8d5aba6e31547449e2a93e3723917cb864dfa4252c493fa52203ef65b8524291b23
SSDEEP 6144:bHs309dvxFNFaFeFOFwcGF6cmFWc0FWc8cIcKcUFJFpcNcHc7cbchFFc5cbc1czX:bs309FxFNFaFeFOFwcGF6cmFWc0FWc8q
TLSH
T13E645B4433DC661AE2FF67B8B57118808B74E953666BD31D7CC060AE1E63B80A983777
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

323694

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\dev\sqlite\dotnet\obj\2008\System.Data.SQLite.2008\Release\System.Data.SQLite.pdb

system.data.sqlite.linq.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 96cab617a16634a5a0a9773e9fa83297a138ab6e096c6eeb8dd0c448a3393bf8
MD5 46e3fd5c43df58be5168aefb372068cd
SHA1 b2838ef6155d0847f32ac2ba84de3044fca152bc
SHA512 26ed87ca520b26e68c1aafd1284fea3b45110b631afd0f4dc6b122b71223abbef31469f2bb2618dd6fdbf62127810619b67763f19eb7070735340dceaedd41c7
SSDEEP 1536:ry6ndADEGsskUhz6KP8cW1xffAaD9HzxOkCabgekUh0UG:rPdAgWN6KP8cW1ec9UXaZkaPG
TLSH
T108148629B3F09E31C1AA42302975355CBDF481F3233D5598FE9E63ED9F6A81106A3B91
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

191246

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\dev\sqlite\dotnet\obj\2008\System.Data.SQLite.Linq.2008\Release\System.Data.SQLite.Linq.pdb

jaffacakes118_Trojan.Win32.Snojan.boiy.985f111df05d1fc75b53633d651f2b61

mscoree

dotnet

system.data.sqlite.dll

mscoree

dotnet

system.data.sqlite.linq.dll

mscoree

dotnet

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_Trojan.Win32.Snojan.boiy.985f111df05d1fc75b53633d651f2b61

mscoree

dotnet

system.data.sqlite.dll

mscoree

dotnet

system.data.sqlite.linq.dll

mscoree

dotnet