jaffacakes118_Virus[.]Win32[.]Qvod[.]f[.]4d9f8db0b9adfe2581a30

General

Target
jaffacakes118_Virus.Win32.Qvod.f.4d9f8db0b9adfe2581a30
Size 136KB
Sample261014-ppx28avxb1
SHA256 385370400564b8a4ef8b422a6ffbf53dc9d150ea2d185570678415eaa7f8a190
MD5 a66928b9e904d9f8db0b9adfe2581a30
SHA1 dc96b2f54f0a1802a6272d9d1bb8bfc9b0aa095f
SHA512 5fac23e1721fa6c0667f019a379d156c58b1ef372767102e92820154a1398dc35139e09a55067edcd2109569fee8de43a143d21b5e6f9003076685ad91a527de
SSDEEP 1536:cMASiLNFZdO/NTpxQaklLkdbbCzJ7VyzypXbPvt/eZHcpUAIznWcLKf67OWugLrL:c3vO/NGlLEDAIznZKCoY
TLSH
T100D36DBA1754A13BC4E2013122655B9A4EFE7F795838EC0BCB541E493AFA5EBD230353
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Virus.Win32.Qvod.f.4d9f8db0b9adfe2581a30

File Explorer

jaffacakes118_Virus.Win32.Qvod.f.4d9f8db0b9adfe2581a30

.exe 136KB

jaffacakes118_Virus.Win32.Qvod.f.4d9f8db0b9adfe2581a30

IMPHASH 2a1c59f2822a4b9e0435e5c824306502
SHA256 385370400564b8a4ef8b422a6ffbf53dc9d150ea2d185570678415eaa7f8a190
MD5 a66928b9e904d9f8db0b9adfe2581a30
SHA1 dc96b2f54f0a1802a6272d9d1bb8bfc9b0aa095f
SHA512 5fac23e1721fa6c0667f019a379d156c58b1ef372767102e92820154a1398dc35139e09a55067edcd2109569fee8de43a143d21b5e6f9003076685ad91a527de
SSDEEP 1536:cMASiLNFZdO/NTpxQaklLkdbbCzJ7VyzypXbPvt/eZHcpUAIznWcLKf67OWugLrL:c3vO/NGlLEDAIznZKCoY
TLSH
T100D36DBA1754A13BC4E2013122655B9A4EFE7F795838EC0BCB541E493AFA5EBD230353
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

32768

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_BIND IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

GetTokenInformation RegQueryValueExA RegOpenKeyExA RegSetValueExA RegCreateKeyExA RegDeleteKeyA RegDeleteValueA RegQueryInfoKeyA FreeSid EqualSid RegCloseKey OpenProcessToken AllocateAndInitializeSid AdjustTokenPrivileges LookupPrivilegeValueA

kernel32

GetCommandLineA lstrcpyA GetModuleHandleA CloseHandle ExitProcess GetCurrentProcessId CopyFileA SetFileAttributesA lstrlenA DeleteFileA GetTempFileNameA GetTempPathA GetFileAttributesA GetLastError CreateMutexA GetModuleFileNameA OpenProcess lstrcpynA ReleaseMutex WritePrivateProfileStringA MultiByteToWideChar GetPrivateProfileStringA FreeLibrary WideCharToMultiByte GetProcAddress LoadLibraryA lstrcatA lstrcmpiA lstrcmpA RemoveDirectoryA IsDBCSLeadByte GetWindowsDirectoryA GetSystemDirectoryA FindClose FindFirstFileA FindNextFileA GetVersionExA LocalFree LocalAlloc GetCurrentProcess GetExitCodeProcess CreateProcessA

user32

DispatchMessageA FindWindowA MessageBoxA wsprintfA EnumChildWindows PostMessageA GetWindowThreadProcessId DestroyWindow CreateDialogParamA TranslateMessage LoadStringA MsgWaitForMultipleObjects ExitWindowsEx CharPrevA CharUpperA CharNextA PeekMessageA

ole32

CoInitialize CLSIDFromString CoUninitialize CoCreateInstance

oleaut32

SysFreeString

Sharing