jaffacakes118_Virus[.]Win32[.]Virut[.]ce[.]3221a1892ae15f9d90afbe5d968c5ef5

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Virus.Win32.Virut.ce.3221a1892ae15f9d90afbe5d968c5ef5
Size 51KB
Sample261014-p5tpqsds2q
SHA256 0f750a6ca4ed9e792f4deabc6360bcd4c3b8f7561e73be7c185b0ff8705631f7
MD5 3221a1892ae15f9d90afbe5d968c5ef5
SHA1 4d4fcbcc68053e25a6865ef874c6adac05946983
SHA512 156cdedd95bebe9fdecd62c2d79ff5fa03d060fd634f58f9c7a4a9dbf495668f818f469f8144a3fa041750af11f4eabce9de22f8be7e20fda88ea7405176fec7
SSDEEP 1536:uMJbDMDSA7FxffJaLaSLGM8dbewJkOehFz3KquU+u:JJbDMOmFCLGM8dTTsJ3KO+u
TLSH
T1BA338D012BA9613DF0E65970967E85225A7AFDB21F11D3CFC6409ACF6874A92993033F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Virus.Win32.Virut.ce.3221a1892ae15f9d90afbe5d968c5ef5

File Explorer

jaffacakes118_Virus.Win32.Virut.ce.3221a1892ae15f9d90afbe5d968c5ef5

.exe 51KB

jaffacakes118_Virus.Win32.Virut.ce.3221a1892ae15f9d90afbe5d968c5ef5

IMPHASH f752af36170e273f3502f811b9235c7f
SHA256 0f750a6ca4ed9e792f4deabc6360bcd4c3b8f7561e73be7c185b0ff8705631f7
MD5 3221a1892ae15f9d90afbe5d968c5ef5
SHA1 4d4fcbcc68053e25a6865ef874c6adac05946983
SHA512 156cdedd95bebe9fdecd62c2d79ff5fa03d060fd634f58f9c7a4a9dbf495668f818f469f8144a3fa041750af11f4eabce9de22f8be7e20fda88ea7405176fec7
SSDEEP 1536:uMJbDMDSA7FxffJaLaSLGM8dbewJkOehFz3KquU+u:JJbDMOmFCLGM8dTTsJ3KO+u
TLSH
T1BA338D012BA9613DF0E65970967E85225A7AFDB21F11D3CFC6409ACF6874A92993033F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

25222

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

userinit.pdb

user32

CreateWindowExW DestroyWindow RegisterClassExW DefWindowProcW LoadRemoteFonts wsprintfW GetSystemMetrics GetKeyboardLayout SystemParametersInfoW GetDesktopWindow LoadStringW MessageBoxW ExitWindowsEx CharNextW

advapi32

RegOpenKeyExA ReportEventW RegisterEventSourceW DeregisterEventSource OpenProcessToken RegCreateKeyExW RegSetValueExW GetUserNameW RegQueryValueExW RegOpenKeyExW RegQueryInfoKeyW RegCloseKey RegQueryValueExA

crypt32

CryptProtectData

winspool.drv

SpoolerInit

ntdll

RtlLengthSid RtlCopySid _itow RtlFreeUnicodeString DbgPrint wcslen wcscpy wcscat wcscmp RtlInitUnicodeString NtOpenKey NtClose _wcsicmp memmove RtlConvertSidToUnicodeString NtQueryInformationToken

netapi32

DsGetDcNameW NetApiBufferFree

wldap32

ord46 ord88 ord14 ord12 ord145 ord73

msvcrt

__setusermatherr _initterm __getmainargs _acmdln _adjust_fdiv _XcptFilter _exit _c_exit __p__commode __p__fmode __set_app_type _except_handler3 _controlfp _cexit exit

kernel32

CompareFileTime LoadLibraryW GetProcAddress FreeLibrary lstrcpyW CreateProcessW lstrlenW GetVersionExW LocalFree LocalAlloc GetEnvironmentVariableW CloseHandle lstrcatW WaitForSingleObject DelayLoadFailureHook GetStartupInfoA GetModuleHandleA SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess GetSystemTimeAsFileTime GetCurrentThreadId GetTickCount QueryPerformanceCounter LoadLibraryA InterlockedCompareExchange LocalReAlloc GetSystemTime lstrcmpW GetCurrentThread SetThreadPriority ExpandEnvironmentStringsW SearchPathW GetLastError CreateThread GetFileAttributesExW GetSystemDirectoryW SetCurrentDirectoryW FormatMessageW lstrcmpiW GetCurrentProcess GetUserDefaultLangID GetCurrentProcessId SetEvent OpenEventW Sleep SetEnvironmentVariableW