jaffacakes118_Trojan[.]Win32[.]Vehidis[.]kk[.]c9563342ff16675b13b3de2a03104495

General

Target
jaffacakes118_Trojan.Win32.Vehidis.kk.c9563342ff16675b13b3de2a03104495
Size 254KB
Sample261014-mwdaaaby2v
SHA256 03b43090d6878ac844cafc011753aa05bef16e9a84b844b9b2777a0331e1b1f5
MD5 c9563342ff16675b13b3de2a03104495
SHA1 3c35a75799a0ba389dadb957ebd34101ba9f1426
SHA512 5de34b0d4bc40d91460cfefa7018220f9fb895bd9bec42f31e2fef3c55092b29b4fae1b83ce4b0fd458a6808bdf7b81bf24130f9081a05ed05c81ed21e85131e
SSDEEP 3072:nQMowIg+1IvM/WLk8eYQUELqsCXggZxG/P4d37X2QcG/VtGgA/eM4oWqrbnyH7fp:JjLk84Uw3gN7jJtAGLqPybp9Dethpi
TLSH
T13A445C05F2CBC0A1F990097068E557BAEA796D311E1F9AF7EB08DF590C33184BE16A17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
jaffacakes118_Trojan.Win32.Vehidis.kk.c9563342ff16675b13b3de2a03104495

File Explorer

jaffacakes118_Trojan.Win32.Vehidis.kk.c9563342ff16675b13b3de2a03104495

.exe 254KB

jaffacakes118_Trojan.Win32.Vehidis.kk.c9563342ff16675b13b3de2a03104495

IMPHASH 6bf7113515a365ba658ddc26fb094576
SHA256 03b43090d6878ac844cafc011753aa05bef16e9a84b844b9b2777a0331e1b1f5
MD5 c9563342ff16675b13b3de2a03104495
SHA1 3c35a75799a0ba389dadb957ebd34101ba9f1426
SHA512 5de34b0d4bc40d91460cfefa7018220f9fb895bd9bec42f31e2fef3c55092b29b4fae1b83ce4b0fd458a6808bdf7b81bf24130f9081a05ed05c81ed21e85131e
SSDEEP 3072:nQMowIg+1IvM/WLk8eYQUELqsCXggZxG/P4d37X2QcG/VtGgA/eM4oWqrbnyH7fp:JjLk84Uw3gN7jJtAGLqPybp9Dethpi
TLSH
T13A445C05F2CBC0A1F990097068E557BAEA796D311E1F9AF7EB08DF590C33184BE16A17
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

25:c4:33:c5:1c:67:b0:bf:0e:1b:2c:7e:7e:01:89:56:d8:38:bf:25

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Tencent Technology(Shenzhen) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Tencent Technology(Shenzhen) Company Limited,L=shenzhen,ST=guangdong,C=CN

Chains

Jan 31, 2013

CN=Tencent Technology(Shenzhen) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Tencent Technology(Shenzhen) Company Limited,L=shenzhen,ST=guangdong,C=CN

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

4d:62:90:e5:8c:54:f0:f1:eb:17:34:1a:13:10:e6:a4

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Sep 30, 2010 - Jan 1, 2014

Subject

CN=Tencent Technology(Shenzhen) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Tencent Technology(Shenzhen) Company Limited,L=shenzhen,ST=guangdong,C=CN

Serial Number

71:70:bd:93:cf:3f:18:9a:e6:45:2b:51:4c:49:34:0e

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 17, 2013 - Feb 16, 2016

Minor OS version

0

Major OS version

4

Entry point

145661

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LoadLibraryA GetProcAddress lstrcpyA lstrlenA WaitForSingleObject CloseHandle Sleep MultiByteToWideChar lstrcmpiA GetTickCount OpenEventA SetErrorMode CreateThread lstrcmpA LocalFree RtlUnwind HeapAlloc HeapFree RaiseException GetLastError GetCurrentThreadId TlsSetValue TlsGetValue ExitThread MoveFileA GetModuleHandleA GetStartupInfoA GetCommandLineA GetVersion ExitProcess TlsAlloc SetLastError GetModuleFileNameA GetEnvironmentVariableA GetVersionExA HeapDestroy HeapCreate VirtualFree VirtualAlloc HeapReAlloc IsBadWritePtr InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection TerminateProcess GetCurrentProcess HeapSize SetUnhandledExceptionFilter UnhandledExceptionFilter FreeEnvironmentStringsA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStrings GetEnvironmentStringsW SetHandleCount GetStdHandle GetFileType WriteFile IsBadReadPtr IsBadCodePtr GetStringTypeA GetStringTypeW SetFilePointer InterlockedDecrement InterlockedIncrement GetCPInfo GetACP GetOEMCP FlushFileBuffers SetStdHandle LCMapStringA LCMapStringW FreeLibrary LocalAlloc InterlockedExchange

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_Trojan.Win32.Vehidis.kk.c9563342ff16675b13b3de2a03104495

PE Signature issue

kernel32

generic