jaffacakes118_Virus[.]Win32[.]Sality[.]gen[.]0020f9ae4f4fab540bad030b99c0d7c0

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Virus.Win32.Sality.gen.0020f9ae4f4fab540bad030b99c0d7c0
Size 1.1MB
Sample261014-pp46jagb96
SHA256 8891a7bd82a4b07968cad0ced261dd74be53a585f28012c1619bc1bd97e39760
MD5 0020f9ae4f4fab540bad030b99c0d7c0
SHA1 72321e7b1eeb8e89ddaf79464f9f7e915bbc2ead
SHA512 7229bbea59da9423163f940ac3451b665a6578ce23f16b92065f7b2087927de68369a27db04652dc06f184b43699c240cb2733adf8922f0bb982a27b5e57605c
SSDEEP 24576:3+O/h69nTnguYDDD1Iq+Q5OS8QmoaMQv4:3+mgnzur1IqTOXQeA
TLSH
T19535C012BAE1C072D45722325ADD5B659EF3BD924E30848FBBDC0A5D5F202C19DBA34B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Virus.Win32.Sality.gen.0020f9ae4f4fab540bad030b99c0d7c0

File Explorer

jaffacakes118_Virus.Win32.Sality.gen.0020f9ae4f4fab540bad030b99c0d7c0

.exe 1.1MB

jaffacakes118_Virus.Win32.Sality.gen.0020f9ae4f4fab540bad030b99c0d7c0

IMPHASH dcd1f1a129c6bb20e5fd347ffa5fae9f
SHA256 8891a7bd82a4b07968cad0ced261dd74be53a585f28012c1619bc1bd97e39760
MD5 0020f9ae4f4fab540bad030b99c0d7c0
SHA1 72321e7b1eeb8e89ddaf79464f9f7e915bbc2ead
SHA512 7229bbea59da9423163f940ac3451b665a6578ce23f16b92065f7b2087927de68369a27db04652dc06f184b43699c240cb2733adf8922f0bb982a27b5e57605c
SSDEEP 24576:3+O/h69nTnguYDDD1Iq+Q5OS8QmoaMQv4:3+mgnzur1IqTOXQeA
TLSH
T19535C012BAE1C072D45722325ADD5B659EF3BD924E30848FBBDC0A5D5F202C19DBA34B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

548662

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\workspace\shuame_pc_all\Shuame\Builder\Release\Installer\Setup\Basic\Bin\Uninst.pdb

kernel32

GetFullPathNameW GetFullPathNameA CreateFileA SetFilePointer MapViewOfFile SetEndOfFile QueryPerformanceCounter InterlockedCompareExchange UnlockFile LockFile UnlockFileEx GetSystemTimeAsFileTime FormatMessageA WriteFile FormatMessageW GetVersionExW GetFileAttributesA GetFileAttributesW FlushFileBuffers LockFileEx GetDiskFreeSpaceW LoadLibraryA GetDiskFreeSpaceA GetSystemInfo GetFileAttributesExW DeleteFileW GetTempPathA LocalFree GetSystemTime AreFileApisANSI DeleteFileA GetLocalTime GetSystemDirectoryW MulDiv lstrcmpW GetWindowsDirectoryW FindNextFileW FindClose GetTempPathW CopyFileW GetTickCount FindFirstFileW GetTempFileNameW GetCommandLineW GetVersion GetCurrentThreadId DeleteCriticalSection lstrcmpiW CreateFileMappingW SetEnvironmentVariableA GetDriveTypeA GetCurrentDirectoryA WriteConsoleW GetConsoleOutputCP EnterCriticalSection SetStdHandle GetLocaleInfoW GetModuleHandleA IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetStringTypeA GetConsoleMode GetConsoleCP GetEnvironmentStringsW FreeEnvironmentStringsW GetStartupInfoA GetFileType SetHandleCount InitializeCriticalSectionAndSpinCount GetTimeZoneInformation GetModuleFileNameA GetStdHandle HeapCreate TlsFree TlsSetValue TlsAlloc TlsGetValue IsValidCodePage GetOEMCP GetACP CompareStringW CompareStringA GetStringTypeW LCMapStringA LCMapStringW RtlUnwind GetCPInfo GetStartupInfoW CreateThread ExitThread ExitProcess IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter InterlockedExchange VirtualAlloc VirtualFree IsProcessorFeaturePresent HeapSize HeapReAlloc HeapDestroy SetWaitableTimer CreateWaitableTimerW ResetEvent HeapFree GetProcessHeap HeapAlloc RemoveDirectoryW CreateDirectoryW MoveFileExW MoveFileW SetFileAttributesW ReleaseMutex SetEvent CreateEventW CreateMutexW SetLastError RaiseException FlushInstructionCache GlobalUnlock lstrlenW MultiByteToWideChar CreateFileW ReadFile LeaveCriticalSection Sleep WideCharToMultiByte GlobalAlloc InitializeCriticalSection GlobalLock InterlockedDecrement MapViewOfFileEx InterlockedIncrement LoadLibraryExW FreeLibrary UnmapViewOfFile lstrlenA FreeResource GetFileSize GetCurrentProcessId CloseHandle CreateToolhelp32Snapshot Process32NextW QueryDosDeviceW LockResource Process32FirstW GetProcAddress GetLastError GetModuleFileNameW TerminateProcess SizeofResource LoadLibraryW OpenProcess GetModuleHandleW OutputDebugStringW WaitForSingleObject GetCurrentProcess CreateProcessW LoadResource FindResourceW WriteConsoleA FindResourceExW

user32

GetMonitorInfoW CopyRect GetWindowThreadProcessId GetWindow MoveWindow EnableWindow MapWindowPoints SendMessageW CreateWindowExW GetActiveWindow CreateDialogParamW LoadBitmapW ShowWindow UnregisterClassA SetWindowPos GetDesktopWindow SetWindowLongW MonitorFromWindow GetWindowLongW InvalidateRect SetRect RegisterClassExW GetForegroundWindow GetClassInfoExW GetClientRect IsWindowEnabled LoadCursorW AttachThreadInput GetParent SetForegroundWindow LoadImageW RegisterWindowMessageW CharNextW SetActiveWindow GetWindowRect DestroyWindow SendMessageTimeoutW PostMessageW IsWindow ReleaseDC InflateRect GetDC PtInRect SetCursor UnionRect OffsetRect IsRectEmpty IntersectRect DispatchMessageW DefWindowProcW CallWindowProcW GetDlgCtrlID UpdateWindow ReleaseCapture PostThreadMessageW FindWindowExW FrameRect GetDlgItem PeekMessageW LoadIconW TranslateMessage BeginPaint SetFocus FindWindowW InvalidateRgn GetKeyState KillTimer SetCapture FillRect GetWindowDC PostQuitMessage GetMessageW ScreenToClient SetTimer ClientToScreen EndPaint EqualRect GetCursorPos GetWindowTextW GetFocus GetWindowTextLengthW DestroyIcon SetRectEmpty IsWindowVisible UpdateLayeredWindow DestroyAcceleratorTable IsChild CreateAcceleratorTableW RedrawWindow GetClassNameW SetWindowTextW GetSysColor

gdi32

CreateCompatibleDC CreateCompatibleBitmap ExtSelectClipRgn CreateSolidBrush CreateRectRgnIndirect CombineRgn SelectObject RectInRegion CreateFontIndirectW DeleteObject GetObjectW GetStockObject GetTextMetricsW BitBlt DeleteDC CreateDIBSection GetCurrentObject SetTextColor GetDeviceCaps

advapi32

AdjustTokenPrivileges LookupPrivilegeValueW RegOpenKeyW RegQueryValueExW OpenProcessToken RegSetValueExW RegCloseKey RegEnumKeyExW RegOpenKeyExW RegDeleteValueW RegDeleteKeyW RegQueryInfoKeyW RegCreateKeyExW SetSecurityDescriptorDacl InitializeSecurityDescriptor

shell32

ShellExecuteW SHChangeNotify SHGetSpecialFolderLocation SHGetPathFromIDListW SHGetSpecialFolderPathW

ole32

CoTaskMemFree CreateStreamOnHGlobal CoTaskMemRealloc CoCreateInstance CoTaskMemAlloc OleLockRunning CLSIDFromProgID CLSIDFromString StringFromGUID2 OleInitialize OleUninitialize CoLoadLibrary CoGetClassObject CoInitializeEx CoUninitialize

oleaut32

DispCallFunc LoadTypeLi VariantInit SysStringLen VariantClear OleCreateFontIndirect SysStringByteLen LoadRegTypeLi SysAllocStringLen SysAllocStringByteLen SysAllocString SysFreeString VarUI4FromStr

shlwapi

SHDeleteValueW PathFileExistsW PathFindFileNameW SHDeleteKeyW StrToIntA

comctl32

_TrackMouseEvent

gdiplus

GdipLoadImageFromStream GdipDeleteBrush GdipFree GdipCloneBrush GdipCreateStringFormat GdipSetPenDashStyle GdipDrawLineI GdipDrawRectangleI GdipCreatePen1 GdipDeletePen GdipDeleteMatrix GdipTranslateWorldTransform GdipGetWorldTransform GdipRotateWorldTransform GdipSetWorldTransform GdipCreateMatrix GdipGetInterpolationMode GdipSetClipHrgn GdipSetPixelOffsetMode GdipSetInterpolationMode GdipSetCompositingQuality GdipSetCompositingMode GdipDrawImageI GdipSetSmoothingMode GdipCreateRegion GdipDeleteRegion GdipGetImageGraphicsContext GdipSetClipRectI GdipCreateBitmapFromScan0 GdipGetClip GdipSetTextRenderingHint GdipSetClipRegion GdipDeleteStringFormat GdipSetStringFormatTrimming GdipSetStringFormatHotkeyPrefix GdipStringFormatGetGenericTypographic GdipCreateFromHDC GdipCloneStringFormat GdipDrawString GdipSetStringFormatAlign GdipGetStringFormatTrimming GdipDeleteGraphics GdipGetStringFormatHotkeyPrefix GdipSetStringFormatLineAlign GdipMeasureString GdipGetStringFormatFlags GdipSetStringFormatFlags GdiplusStartup GdipGetImageWidth GdipCloneImage GdipFillRectangleI GdipCreateFontFamilyFromName GdipCreateImageAttributes GdipGetGenericFontFamilySansSerif GdipCreateBitmapFromHBITMAP GdipCreateFont GdipDisposeImage GdipAlloc GdipDisposeImageAttributes GdipCreateSolidFill GdipDeleteFontFamily GdipDrawImageRectI GdipDeleteFont GdipDrawImageRectRectI GdipDrawImagePointRectI GdipGetImageHeight GdipSetImageAttributesColorMatrix

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

iphlpapi

GetAdaptersInfo GetPerAdapterInfo

netapi32

Netbios

wininet

InternetReadFileExA InternetOpenW InternetConnectW HttpQueryInfoW InternetCloseHandle InternetSetStatusCallbackW HttpEndRequestW InternetWriteFile HttpSendRequestExW InternetCrackUrlW HttpOpenRequestW InternetSetOptionW

sqlite3_aggregate_context sqlite3_aggregate_count sqlite3_auto_extension sqlite3_backup_finish sqlite3_backup_init sqlite3_backup_pagecount sqlite3_backup_remaining sqlite3_backup_step sqlite3_bind_blob sqlite3_bind_double sqlite3_bind_int sqlite3_bind_int64 sqlite3_bind_null sqlite3_bind_parameter_count sqlite3_bind_parameter_index sqlite3_bind_parameter_name sqlite3_bind_text sqlite3_bind_text16 sqlite3_bind_value sqlite3_bind_zeroblob sqlite3_blob_bytes sqlite3_blob_close sqlite3_blob_open sqlite3_blob_read sqlite3_blob_reopen sqlite3_blob_write sqlite3_busy_handler sqlite3_busy_timeout sqlite3_changes sqlite3_clear_bindings sqlite3_close sqlite3_collation_needed sqlite3_collation_needed16 sqlite3_column_blob sqlite3_column_bytes sqlite3_column_bytes16 sqlite3_column_count sqlite3_column_decltype sqlite3_column_decltype16 sqlite3_column_double sqlite3_column_int sqlite3_column_int64 sqlite3_column_name sqlite3_column_name16 sqlite3_column_text sqlite3_column_text16 sqlite3_column_type sqlite3_column_value sqlite3_commit_hook sqlite3_compileoption_get sqlite3_compileoption_used sqlite3_complete sqlite3_complete16 sqlite3_config sqlite3_context_db_handle sqlite3_create_collation sqlite3_create_collation16 sqlite3_create_collation_v2 sqlite3_create_function sqlite3_create_function16 sqlite3_create_function_v2 sqlite3_create_module sqlite3_create_module_v2 sqlite3_data_count sqlite3_db_config sqlite3_db_handle sqlite3_db_mutex sqlite3_db_status sqlite3_declare_vtab sqlite3_enable_load_extension sqlite3_enable_shared_cache sqlite3_errcode sqlite3_errmsg sqlite3_errmsg16 sqlite3_exec sqlite3_expired sqlite3_extended_errcode sqlite3_extended_result_codes sqlite3_file_control sqlite3_finalize sqlite3_free sqlite3_free_table sqlite3_get_autocommit sqlite3_get_auxdata sqlite3_get_table sqlite3_global_recover sqlite3_initialize sqlite3_interrupt sqlite3_last_insert_rowid sqlite3_libversion sqlite3_libversion_number sqlite3_limit sqlite3_load_extension sqlite3_log sqlite3_malloc sqlite3_memory_alarm sqlite3_memory_highwater sqlite3_memory_used sqlite3_mprintf sqlite3_mutex_alloc sqlite3_mutex_enter sqlite3_mutex_free sqlite3_mutex_leave sqlite3_mutex_try sqlite3_next_stmt sqlite3_open sqlite3_open16 sqlite3_open_v2 sqlite3_os_end sqlite3_os_init sqlite3_overload_function sqlite3_prepare sqlite3_prepare16 sqlite3_prepare16_v2 sqlite3_prepare_v2 sqlite3_profile sqlite3_progress_handler sqlite3_randomness sqlite3_realloc sqlite3_release_memory sqlite3_reset sqlite3_reset_auto_extension sqlite3_result_blob sqlite3_result_double sqlite3_result_error sqlite3_result_error16 sqlite3_result_error_code sqlite3_result_error_nomem sqlite3_result_error_toobig sqlite3_result_int sqlite3_result_int64 sqlite3_result_null sqlite3_result_text sqlite3_result_text16 sqlite3_result_text16be sqlite3_result_text16le sqlite3_result_value sqlite3_result_zeroblob sqlite3_rollback_hook sqlite3_set_authorizer sqlite3_set_auxdata sqlite3_shutdown sqlite3_sleep sqlite3_snprintf sqlite3_soft_heap_limit sqlite3_soft_heap_limit64 sqlite3_sourceid sqlite3_sql sqlite3_status sqlite3_step sqlite3_stmt_readonly sqlite3_stmt_status sqlite3_strnicmp sqlite3_temp_directory sqlite3_test_control sqlite3_thread_cleanup sqlite3_threadsafe sqlite3_total_changes sqlite3_trace sqlite3_transfer_bindings sqlite3_update_hook sqlite3_uri_parameter sqlite3_user_data sqlite3_value_blob sqlite3_value_bytes sqlite3_value_bytes16 sqlite3_value_double sqlite3_value_int sqlite3_value_int64 sqlite3_value_numeric_type sqlite3_value_text sqlite3_value_text16 sqlite3_value_text16be sqlite3_value_text16le sqlite3_value_type sqlite3_version sqlite3_vfs_find sqlite3_vfs_register sqlite3_vfs_unregister sqlite3_vmprintf sqlite3_vsnprintf sqlite3_vtab_config sqlite3_vtab_on_conflict sqlite3_wal_autocheckpoint sqlite3_wal_checkpoint sqlite3_wal_checkpoint_v2 sqlite3_wal_hook sqlite3_win32_mbcs_to_utf8 sqlite3_win32_utf8_to_mbcs