jaffacakes118_Virus[.]Win32[.]Virut[.]ce[.]6952c3273e67996fb640ce1bb5da7a82

General

Target
jaffacakes118_Virus.Win32.Virut.ce.6952c3273e67996fb640ce1bb5da7a82
Size 43KB
Sample261014-p6n6msgc54
SHA256 b7f4f63138db3932783ceec694c185b81c8b7c9dbc32f5f3d0d75ca2964fdb8c
MD5 6952c3273e67996fb640ce1bb5da7a82
SHA1 5a9e7620aa570b42a3862e7ca480dd98d6404e51
SHA512 d323b94c0d442802021ee72718ccaa9a5e36e53ef4d5f8c3eecd483fc313ecdae38f846991b2865cab761211e543abbc6308ee971632c4d6d05d7ab07aca2690
SSDEEP 768:Kik7WZ3xzsQsD5O8L3i4vzRTCPqZ3JSDC7CXPGtvtg:d2xO8L31QCZ3eiG
TLSH
T10213DF25E096237FD3E221B557903621961E3E1B9F0883DBF56FD1233E987B28574483
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Virus.Win32.Virut.ce.6952c3273e67996fb640ce1bb5da7a82

File Explorer

jaffacakes118_Virus.Win32.Virut.ce.6952c3273e67996fb640ce1bb5da7a82

.exe 43KB

jaffacakes118_Virus.Win32.Virut.ce.6952c3273e67996fb640ce1bb5da7a82

IMPHASH 4c0510c44a9a3d9cde6ebe3eb35b8e7d
SHA256 b7f4f63138db3932783ceec694c185b81c8b7c9dbc32f5f3d0d75ca2964fdb8c
MD5 6952c3273e67996fb640ce1bb5da7a82
SHA1 5a9e7620aa570b42a3862e7ca480dd98d6404e51
SHA512 d323b94c0d442802021ee72718ccaa9a5e36e53ef4d5f8c3eecd483fc313ecdae38f846991b2865cab761211e543abbc6308ee971632c4d6d05d7ab07aca2690
SSDEEP 768:Kik7WZ3xzsQsD5O8L3i4vzRTCPqZ3JSDC7CXPGtvtg:d2xO8L31QCZ3eiG
TLSH
T10213DF25E096237FD3E221B557903621961E3E1B9F0883DBF56FD1233E987B28574483
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

52166

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

chkdsk.pdb

ulib

?Get_Standard_Input_Stream@@YGPAVSTREAM@@XZ ??0PATH@@QAE@XZ ??0CHKDSK_MESSAGE@@QAE@XZ ??0PATH_ARGUMENT@@QAE@XZ ??0STRING_ARGUMENT@@QAE@XZ ?EnableBreakHandling@KEYBOARD@@SGEXZ ??0FLAG_ARGUMENT@@QAE@XZ ?Initialize@ARRAY@@QAEEKK@Z ?Get_Standard_Output_Stream@@YGPAVSTREAM@@XZ ??0FSTRING@@QAE@XZ ??0DSTRING@@QAE@XZ ?Initialize@ARGUMENT_LEXEMIZER@@QAEEPAVARRAY@@@Z ?QueryLibraryEntryPoint@SYSTEM@@SGP6GHXZPBVWSTRING@@0PAPAX@Z ?Initialize@FLAG_ARGUMENT@@QAEEPAD@Z ?Initialize@LONG_ARGUMENT@@QAEEPAD@Z ?Initialize@STRING_ARGUMENT@@QAEEPAD@Z ?Initialize@PATH_ARGUMENT@@QAEEPADE@Z ?Initialize@CHKDSK_MESSAGE@@QAEEPAVSTREAM@@00@Z ??0ARGUMENT_LEXEMIZER@@QAE@XZ ?Initialize@WSTRING@@QAEEPBDK@Z ??1PATH@@UAE@XZ ??1CHKDSK_MESSAGE@@UAE@XZ ??1PATH_ARGUMENT@@UAE@XZ ?SetCaseSensitive@ARGUMENT_LEXEMIZER@@QAEXE@Z ?Put@ARRAY@@UAEEPAVOBJECT@@@Z ?PrepareToParse@ARGUMENT_LEXEMIZER@@QAEEPAVWSTRING@@@Z ?DoParsing@ARGUMENT_LEXEMIZER@@QAEEPAVARRAY@@@Z ?Set@CHKDSK_MESSAGE@@UAEEKW4MESSAGE_TYPE@@K@Z ?QueryInvalidArgument@ARGUMENT_LEXEMIZER@@QAEPAVWSTRING@@XZ ?IsValueSet@ARGUMENT@@QAEEXZ ?QueryCurrentDosDriveName@SYSTEM@@SGEPAVWSTRING@@@Z ?Initialize@PATH@@QAEEPBVWSTRING@@E@Z ?AnalyzePath@PATH@@QAE?AW4PATH_ANALYZE_CODE@@PAVWSTRING@@PAV1@0@Z ?IsDrive@PATH@@QBEEXZ ?IsGuidVolName@PATH@@QAEEXZ ?Initialize@WSTRING@@QAEEPBV1@KK@Z ?AppendString@PATH@@QAEEPBVWSTRING@@@Z ?QueryDriveType@SYSTEM@@SG?AW4DRIVE_TYPE@@PBVWSTRING@@@Z ?QueryWSTR@WSTRING@@QBEPAGKKPAGKE@Z ?Initialize@WSTRING@@QAEEPBGK@Z ?Log@MESSAGE@@QAAEPBDZZ ?Strcat@WSTRING@@QAEEPBV1@@Z ?Initialize@FSTRING@@QAEPAVWSTRING@@PAGK@Z ??0ARRAY@@QAE@XZ ??1STRING_ARGUMENT@@UAE@XZ ??1ARRAY@@UAE@XZ ??1ARGUMENT_LEXEMIZER@@UAE@XZ ??1FSTRING@@UAE@XZ ?QueryNextLibraryEntryPoint@SYSTEM@@SGP6GHXZPAXPBVWSTRING@@@Z ?FreeLibraryHandle@SYSTEM@@SGXPAX@Z ?DisableBreakHandling@KEYBOARD@@SGEXZ ?MakeFileToken@MESSAGE@@SG_KPBD@Z ?DisplayMsg@MESSAGE@@QAAEKW4MESSAGE_TYPE@@KPBDZZ ??1DSTRING@@UAE@XZ ??1OBJECT@@UAE@XZ ??0LONG_ARGUMENT@@QAE@XZ ?Display@MESSAGE@@QAAEPBDZZ

ifsutil

?GetSnapshotNtDeviceName@SNAPSHOT@@QAEPAGXZ ?GetVolumeSnapshot@SNAPSHOT@@SGEPAVWSTRING@@PAPAV1@@Z ?QueryFileSystemName@IFS_SYSTEM@@SGEPBVWSTRING@@PAV2@PAJ1@Z ?DosDriveNameToNtDriveName@IFS_SYSTEM@@SGEPBVWSTRING@@PAV2@@Z ?ReleaseVolumeSnapshot@SNAPSHOT@@SGEPAV1@@Z

kernel32

UnhandledExceptionFilter TerminateProcess GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter GetModuleHandleA SetUnhandledExceptionFilter InterlockedCompareExchange Sleep InterlockedExchange HeapSetInformation SetErrorMode GetCurrentProcess

msvcrt

?terminate@@YAXXZ _except_handler4_common __set_app_type __p__fmode __p__commode __setusermatherr _amsg_exit _controlfp exit _XcptFilter _exit _cexit __getmainargs _wcsupr _wcsicmp _initterm

Sharing