jaffacakes118_Trojan[.]Win32[.]Snojan[.]bole[.]49821f5ef50f7421bcc4151d7d85749b

General

Target
jaffacakes118_Trojan.Win32.Snojan.bole.49821f5ef50f7421bcc4151d7d85749b
Size 1.2MB
Sample261014-mly41atses
SHA256 45b378597670a767bac4f3ad5e435e2738e23234deafe31dd7c8ee1b964b9c61
MD5 49821f5ef50f7421bcc4151d7d85749b
SHA1 37738502d1267ba7fe5fec669955448250d15558
SHA512 b8c4f3e77b1b3cd612685e4c6622c223055887620931118d487cce9eb2d02ec311f3d65b558dcac5c8a52b76a952c53f0cfc0645466f06245ed5c8c88978c155
SSDEEP 24576:kY9UEMx2jZTKKlgbFYMXZbj9gZVbo2KyMLHjxRJfBpUKrly0eBfX:8EMxYZTKKlSgoQQNzfBGKJy06
TLSH
T1FC45BF82FAD2C1F1FE9531BD42BA5A7B0D396B055326C4D7A6981D80CE711E2763F382
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan.Win32.Snojan.bole.49821f5ef50f7421bcc4151d7d85749b
unpack001/system.data.sqlite.dll
unpack001/system.data.sqlite.linq.dll

File Explorer

jaffacakes118_Trojan.Win32.Snojan.bole.49821f5ef50f7421bcc4151d7d85749b

.exe 1.2MB
system.data.sqlite.dll

.dll 324KB
system.data.sqlite.linq.dll

.dll 192KB

jaffacakes118_Trojan.Win32.Snojan.bole.49821f5ef50f7421bcc4151d7d85749b

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 45b378597670a767bac4f3ad5e435e2738e23234deafe31dd7c8ee1b964b9c61
MD5 49821f5ef50f7421bcc4151d7d85749b
SHA1 37738502d1267ba7fe5fec669955448250d15558
SHA512 b8c4f3e77b1b3cd612685e4c6622c223055887620931118d487cce9eb2d02ec311f3d65b558dcac5c8a52b76a952c53f0cfc0645466f06245ed5c8c88978c155
SSDEEP 24576:kY9UEMx2jZTKKlgbFYMXZbj9gZVbo2KyMLHjxRJfBpUKrly0eBfX:8EMxYZTKKlSgoQQNzfBGKJy06
TLSH
T1FC45BF82FAD2C1F1FE9531BD42BA5A7B0D396B055326C4D7A6981D80CE711E2763F382
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

1249390

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\BABLIK\Documents\Visual Studio 2017\Projects\WindowsFormsApp14\WindowsFormsApp14\obj\Release\microsoft_ms.pdb

system.data.sqlite.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d44f9ddd0362306bc059d3cf8a9691eb219e26296ec4ad2f5f5f58ad10f77ca7
MD5 09e1d3884873594523eeff74d5e329d4
SHA1 4551ed1d3cdb2dfa2169d1934fb7d180811102c4
SHA512 2afff744a34d7f1844903dfc70f64111b5766f06402b9f68ae55fec3bc73e8d5aba6e31547449e2a93e3723917cb864dfa4252c493fa52203ef65b8524291b23
SSDEEP 6144:bHs309dvxFNFaFeFOFwcGF6cmFWc0FWc8cIcKcUFJFpcNcHc7cbchFFc5cbc1czX:bs309FxFNFaFeFOFwcGF6cmFWc0FWc8q
TLSH
T13E645B4433DC661AE2FF67B8B57118808B74E953666BD31D7CC060AE1E63B80A983777
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

323694

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\dev\sqlite\dotnet\obj\2008\System.Data.SQLite.2008\Release\System.Data.SQLite.pdb

system.data.sqlite.linq.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 96cab617a16634a5a0a9773e9fa83297a138ab6e096c6eeb8dd0c448a3393bf8
MD5 46e3fd5c43df58be5168aefb372068cd
SHA1 b2838ef6155d0847f32ac2ba84de3044fca152bc
SHA512 26ed87ca520b26e68c1aafd1284fea3b45110b631afd0f4dc6b122b71223abbef31469f2bb2618dd6fdbf62127810619b67763f19eb7070735340dceaedd41c7
SSDEEP 1536:ry6ndADEGsskUhz6KP8cW1xffAaD9HzxOkCabgekUh0UG:rPdAgWN6KP8cW1ec9UXaZkaPG
TLSH
T108148629B3F09E31C1AA42302975355CBDF481F3233D5598FE9E63ED9F6A81106A3B91
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

191246

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\dev\sqlite\dotnet\obj\2008\System.Data.SQLite.Linq.2008\Release\System.Data.SQLite.Linq.pdb

jaffacakes118_Trojan.Win32.Snojan.bole.49821f5ef50f7421bcc4151d7d85749b

mscoree

dotnet

system.data.sqlite.dll

mscoree

dotnet

system.data.sqlite.linq.dll

mscoree

dotnet

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_Trojan.Win32.Snojan.bole.49821f5ef50f7421bcc4151d7d85749b

mscoree

dotnet

system.data.sqlite.dll

mscoree

dotnet

system.data.sqlite.linq.dll

mscoree

dotnet