jaffacakes118_Worm[.]Win32[.]AutoRun[.]edrh[.]68aacf8f7bdff8d5e6427ad912a8841b

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Worm.Win32.AutoRun.edrh.68aacf8f7bdff8d5e6427ad912a8841b
Size 58KB
Sample261014-p9tkjasv2r
SHA256 29bf37c3f56ae676b4824ef8d51396897fe8734949b2e6d9358c9779c8c22c30
MD5 68aacf8f7bdff8d5e6427ad912a8841b
SHA1 b7083c2a25d6737ac3ba2b8dd38cd4e565250589
SHA512 50854f2c75d352b9fe5ae74a396cdc6c6a64bc8462439d29acd50a694205796d2e57d60f093f359b00023bf46fff731675d609e4cbd75f56a74259e0d2e04b1c
SSDEEP 768:4dICxZk/89MpVT7woQJcW/bnqC03T/yEwSndA/zJmnPi3Jnv:4TYd5QJc/vaSybs4
TLSH
T16D434943BD8418B9E8541031006EBAF6B27BBEA51A2AB9C77F14DCB14833197B639647
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Worm.Win32.AutoRun.edrh.68aacf8f7bdff8d5e6427ad912a8841b

File Explorer

jaffacakes118_Worm.Win32.AutoRun.edrh.68aacf8f7bdff8d5e6427ad912a8841b

.exe .bat 58KB

jaffacakes118_Worm.Win32.AutoRun.edrh.68aacf8f7bdff8d5e6427ad912a8841b

IMPHASH ef2c43bbd1d69c662e975f06c2f3267c
SHA256 29bf37c3f56ae676b4824ef8d51396897fe8734949b2e6d9358c9779c8c22c30
MD5 68aacf8f7bdff8d5e6427ad912a8841b
SHA1 b7083c2a25d6737ac3ba2b8dd38cd4e565250589
SHA512 50854f2c75d352b9fe5ae74a396cdc6c6a64bc8462439d29acd50a694205796d2e57d60f093f359b00023bf46fff731675d609e4cbd75f56a74259e0d2e04b1c
SSDEEP 768:4dICxZk/89MpVT7woQJcW/bnqC03T/yEwSndA/zJmnPi3Jnv:4TYd5QJc/vaSybs4
TLSH
T16D434943BD8418B9E8541031006EBAF6B27BBEA51A2AB9C77F14DCB14833197B639647
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86 polyglot

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

44592

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

MultiByteToWideChar lstrlenA FindClose FindFirstFileA GetSystemDirectoryA MoveFileExA ReadFile WinExec GetTempFileNameA GetTempPathA SetFilePointer lstrcpynA CreateDirectoryA FindNextFileA ReleaseMutex WaitForSingleObject lstrcmpiA lstrcpyA lstrcmpA GetEnvironmentVariableA lstrcatA GetDiskFreeSpaceA GetModuleHandleA Sleep MoveFileA GetLocalTime GetCurrentProcess FormatMessageA GetLastError GetComputerNameA SetFileAttributesW GetSystemTime VirtualAlloc VirtualFree FileTimeToDosDateTime SetEndOfFile DosDateTimeToFileTime ExitProcess SetFileTime SystemTimeToFileTime CreateProcessA GetWindowsDirectoryA CreateMutexA CreateSemaphoreA CreateThread SizeofResource LockResource LoadResource FindResourceA DeviceIoControl HeapFree HeapAlloc GetProcessHeap GetDriveTypeA GetLogicalDrives GetLogicalDriveStringsA FileTimeToSystemTime ReleaseSemaphore OpenSemaphoreA GetFileSize CreateFileMappingA MapViewOfFile WriteFile UnmapViewOfFile CreateFileA GetFileTime CloseHandle DeleteFileA GetModuleFileNameA CopyFileA SetFileAttributesA LoadLibraryA SetCurrentDirectoryA GetProcAddress

user32

CharLowerBuffA wsprintfA DefWindowProcA SetTimer ShowWindow PostQuitMessage EndDialog KillTimer DialogBoxParamA

advapi32

InitializeAcl AddAccessAllowedAce SetSecurityDescriptorDacl SetFileSecurityA InitializeSecurityDescriptor AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken RegSaveKeyA RegOpenKeyExA RegRestoreKeyA RegCloseKey RegQueryValueExA LookupAccountNameA

shell32

SHChangeNotify

ole32

CoInitialize CoUninitialize

msvcrt

strrchr _strcmpi atol isdigit _except_handler3 memmove strchr wcslen strncmp __CxxFrameHandler atoi _strlwr strncpy _findfirst _findclose _findnext

ws2_32

gethostbyname WSAStartup WSACleanup inet_addr