jaffacakes118_Worm[.]Win32[.]AutoRun[.]edrh[.]d23b534cf2c6065bf5bd8f878d9b528a

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Worm.Win32.AutoRun.edrh.d23b534cf2c6065bf5bd8f878d9b528a
Size 230KB
Sample261014-p91c3sgc65
SHA256 b1bc1550aba87dbd056448a5f62f1a22c0a8fb7a4d2b42549b7acbe157027275
MD5 d23b534cf2c6065bf5bd8f878d9b528a
SHA1 0f8cce1c6bb2f5503e286da3b4707442b7a479f4
SHA512 ac5cdeb773596706b75351bb73b1708abf788320e8176bd79465885185ae3e2cae52110025450ae1a945e120b5d966f7adcf5cfc0f170b039d82ae04b376f768
SSDEEP 1536:yZYd5QJc/vaSybs4M0rQQ87eHe3soW7CCDJ85AB0RlAh6:s1c/2b5Qf7857CKJ8AB0RlT
TLSH
T16B34ADA3BD4408B6D0561930064BA7B9B53A75A11A5778C77F15CDB88CBB383BBB9303
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Worm.Win32.AutoRun.edrh.d23b534cf2c6065bf5bd8f878d9b528a

File Explorer

jaffacakes118_Worm.Win32.AutoRun.edrh.d23b534cf2c6065bf5bd8f878d9b528a

.exe .bat 230KB

jaffacakes118_Worm.Win32.AutoRun.edrh.d23b534cf2c6065bf5bd8f878d9b528a

IMPHASH ef2c43bbd1d69c662e975f06c2f3267c
SHA256 b1bc1550aba87dbd056448a5f62f1a22c0a8fb7a4d2b42549b7acbe157027275
MD5 d23b534cf2c6065bf5bd8f878d9b528a
SHA1 0f8cce1c6bb2f5503e286da3b4707442b7a479f4
SHA512 ac5cdeb773596706b75351bb73b1708abf788320e8176bd79465885185ae3e2cae52110025450ae1a945e120b5d966f7adcf5cfc0f170b039d82ae04b376f768
SSDEEP 1536:yZYd5QJc/vaSybs4M0rQQ87eHe3soW7CCDJ85AB0RlAh6:s1c/2b5Qf7857CKJ8AB0RlT
TLSH
T16B34ADA3BD4408B6D0561930064BA7B9B53A75A11A5778C77F15CDB88CBB383BBB9303
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86 polyglot

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

44592

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

MultiByteToWideChar lstrlenA FindClose FindFirstFileA GetSystemDirectoryA MoveFileExA ReadFile WinExec GetTempFileNameA GetTempPathA SetFilePointer lstrcpynA CreateDirectoryA FindNextFileA ReleaseMutex WaitForSingleObject lstrcmpiA lstrcpyA lstrcmpA GetEnvironmentVariableA lstrcatA GetDiskFreeSpaceA GetModuleHandleA Sleep MoveFileA GetLocalTime GetCurrentProcess FormatMessageA GetLastError GetComputerNameA SetFileAttributesW GetSystemTime VirtualAlloc VirtualFree FileTimeToDosDateTime SetEndOfFile DosDateTimeToFileTime ExitProcess SetFileTime SystemTimeToFileTime CreateProcessA GetWindowsDirectoryA CreateMutexA CreateSemaphoreA CreateThread SizeofResource LockResource LoadResource FindResourceA DeviceIoControl HeapFree HeapAlloc GetProcessHeap GetDriveTypeA GetLogicalDrives GetLogicalDriveStringsA FileTimeToSystemTime ReleaseSemaphore OpenSemaphoreA GetFileSize CreateFileMappingA MapViewOfFile WriteFile UnmapViewOfFile CreateFileA GetFileTime CloseHandle DeleteFileA GetModuleFileNameA CopyFileA SetFileAttributesA LoadLibraryA SetCurrentDirectoryA GetProcAddress

user32

CharLowerBuffA wsprintfA DefWindowProcA SetTimer ShowWindow PostQuitMessage EndDialog KillTimer DialogBoxParamA

advapi32

InitializeAcl AddAccessAllowedAce SetSecurityDescriptorDacl SetFileSecurityA InitializeSecurityDescriptor AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken RegSaveKeyA RegOpenKeyExA RegRestoreKeyA RegCloseKey RegQueryValueExA LookupAccountNameA

shell32

SHChangeNotify

ole32

CoInitialize CoUninitialize

msvcrt

strrchr _strcmpi atol isdigit _except_handler3 memmove strchr wcslen strncmp __CxxFrameHandler atoi _strlwr strncpy _findfirst _findclose _findnext

ws2_32

gethostbyname WSAStartup WSACleanup inet_addr