jaffacakes118_Virus[.]Win32[.]Sality[.]gen[.]ea8da1e47374f4ac1cf00

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Virus.Win32.Sality.gen.ea8da1e47374f4ac1cf00
Size 628KB
Sample261014-p2fnpsc17j
SHA256 e1cbddbb600e424f6e4d775fa9a186b0725b1318950cc93bff9ea105969e7334
MD5 01c3a741772ea8da1e47374f4ac1cf00
SHA1 16ff158af45642f4573aec567c955c63b719786a
SHA512 a23d500c8ebd01bad6b06706b5cb891ab1a6a59e6982adc852c94632ce0803134649d2ff89f1795a0f3072dda3cb2f9b0035c45f609e2167263a2aa4ea108e4b
SSDEEP 12288:s+F4EWSsIq7MapxhaRAPNrBQ+2m1SrlnvlzdFbL/4IgG+6ZERVm:F2JBhJPNQCCvlRxDyG+6x
TLSH
T1E4D46C01A641D036F9F315F6DAFE462EAA28AD31170554C7A3C45F6E5F21AF27E3023A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Virus.Win32.Sality.gen.ea8da1e47374f4ac1cf00

File Explorer

jaffacakes118_Virus.Win32.Sality.gen.ea8da1e47374f4ac1cf00

.exe 628KB

jaffacakes118_Virus.Win32.Sality.gen.ea8da1e47374f4ac1cf00

IMPHASH 585480de19ff6ebcd6f6a586a2261800
SHA256 e1cbddbb600e424f6e4d775fa9a186b0725b1318950cc93bff9ea105969e7334
MD5 01c3a741772ea8da1e47374f4ac1cf00
SHA1 16ff158af45642f4573aec567c955c63b719786a
SHA512 a23d500c8ebd01bad6b06706b5cb891ab1a6a59e6982adc852c94632ce0803134649d2ff89f1795a0f3072dda3cb2f9b0035c45f609e2167263a2aa4ea108e4b
SSDEEP 12288:s+F4EWSsIq7MapxhaRAPNrBQ+2m1SrlnvlzdFbL/4IgG+6ZERVm:F2JBhJPNQCCvlRxDyG+6x
TLSH
T1E4D46C01A641D036F9F315F6DAFE462EAA28AD31170554C7A3C45F6E5F21AF27E3023A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

352156

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

e:\build\360CleanHelper1008\Release\360CleanHelper.pdb

psapi

GetModuleFileNameExW

imm32

ImmDisableIME

kernel32

GetLastError InitializeCriticalSection LeaveCriticalSection EnterCriticalSection FreeLibrary MultiByteToWideChar LoadLibraryExW lstrcmpiW GetProcAddress LoadLibraryW CreateMutexW GetEnvironmentVariableW InterlockedCompareExchange lstrlenA GetVersion WideCharToMultiByte CloseHandle OpenProcess GetPrivateProfileStringW WritePrivateProfileStringW GetTempPathW GetTempFileNameW CreateThread GetTickCount GetCurrentThreadId FlushInstructionCache GetCurrentProcess SetLastError WaitForSingleObject InterlockedExchange CreateEventW SetEvent Sleep GetVersionExW GetCommandLineW DeviceIoControl CreateFileW GetCurrentProcessId CreateProcessW GetACP FormatMessageW WriteFile ReadFile GetFileSize SetCurrentDirectoryW GetWindowsDirectoryW ExpandEnvironmentStringsW GetVolumeInformationW FindClose FindNextFileW FindFirstFileW GetDiskFreeSpaceExW SetFilePointer FileTimeToLocalFileTime lstrlenW GetProcessHeap HeapSize InterlockedDecrement SetEnvironmentVariableA CompareStringW CompareStringA WriteConsoleW GetConsoleOutputCP GetModuleHandleW SetStdHandle GetLocaleInfoW GetStringTypeW GetStringTypeA IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW FlushFileBuffers GetConsoleMode GetConsoleCP GetStartupInfoA GetFileType SetHandleCount GetTimeZoneInformation GetModuleHandleA HeapCreate InitializeCriticalSectionAndSpinCount GetModuleFileNameA GetStdHandle IsValidCodePage GetOEMCP GetCPInfo LCMapStringW LCMapStringA GetStartupInfoW IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter InterlockedIncrement FindResourceExW LoadResource LockResource SizeofResource FindResourceW RaiseException SetErrorMode HeapReAlloc GetModuleFileNameW LoadLibraryA TerminateProcess RtlUnwind ExitProcess TlsFree DeleteAtom FindAtomW TlsAlloc ReleaseMutex AddAtomW OpenThread GetAtomNameW HeapFree HeapAlloc HeapDestroy VirtualFree VirtualAlloc WriteConsoleA DeleteCriticalSection CreateFileA SystemTimeToFileTime GetSystemTimeAsFileTime LocalFileTimeToFileTime SetEndOfFile TlsSetValue TlsGetValue GetSystemTime LocalFree OutputDebugStringW GetFileSizeEx SetFilePointerEx IsProcessorFeaturePresent

user32

IsWindow CharNextW FindWindowW BringWindowToTop SetWindowPos SetForegroundWindow UnregisterClassA GetWindowLongW CopyRect GetClientRect MoveWindow SystemParametersInfoW GetSystemMetrics LoadImageW DisableProcessWindowsGhosting RegisterClassExW LoadCursorW GetClassInfoExW GetWindowRect CallWindowProcW CreateWindowExW SetWindowLongW DestroyWindow DefWindowProcW KillTimer SetTimer ShowWindow PostQuitMessage GetMessageW TranslateMessage DispatchMessageW GetActiveWindow MessageBoxW SendMessageW SendMessageTimeoutW GetShellWindow GetWindow GetWindowInfo MonitorFromPoint GetMonitorInfoW EnumDisplaySettingsW GetAncestor GetForegroundWindow GetDesktopWindow GetWindowThreadProcessId WindowFromPoint

advapi32

GetTokenInformation RegQueryValueExW OpenProcessToken RegQueryInfoKeyW RegSetValueExW RegEnumKeyExW RegOpenKeyExW RegCreateKeyExW RegCloseKey RegDeleteValueW RegDeleteKeyW RegQueryValueExA

shell32

ShellExecuteW SHGetSpecialFolderPathW ShellExecuteExW

ole32

CoTaskMemFree CoInitialize CoTaskMemRealloc CoUninitialize CoTaskMemAlloc CoCreateInstance

oleaut32

VariantCopy DispCallFunc SysStringByteLen SysAllocStringByteLen SysAllocString SysFreeString VariantClear VariantInit SystemTimeToVariantTime VariantTimeToSystemTime VarUI4FromStr

shlwapi

SHGetValueW SHSetValueW StrCmpIW PathFindFileNameW PathFileExistsW PathRemoveFileSpecW PathCombineW PathAppendW StrStrIW

wintrust

WinVerifyTrust WTHelperProvDataFromStateData

crypt32

CertGetNameStringW

rpcrt4

NdrClientCall2