jaffacakes118_Virus[.]Win32[.]Sality[.]gen[.]198fb1ea7c740cfae4df0

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Virus.Win32.Sality.gen.198fb1ea7c740cfae4df0
Size 141KB
Sample261014-prcjas116k
SHA256 224977255c6ba164ff8be3857b03018434518148cdf0034064aae2a157dce947
MD5 13eda510493198fb1ea7c740cfae4df0
SHA1 1de28e376979fd75d5b9c24bde79e7c51af6d96c
SHA512 194eabf1fa6e471d21498b8897f6189d3de9fa631fc74e1be6ae47f8d0c7d6c66f1b7ec769585ce359092858f95af9265e6762a493c1d2db80d3754e1f932ddc
SSDEEP 3072:3z83F259UoKTBfO28u1zCyVvbdU7oSiQ6S/pFO:3I3F25jKTBS3y1bG7Ri9SBFO
TLSH
T112E3E1077BF452A3C8720D7099E75A19E7727B240B609B03AB485D943DF6AD2E9313CE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Virus.Win32.Sality.gen.198fb1ea7c740cfae4df0

File Explorer

jaffacakes118_Virus.Win32.Sality.gen.198fb1ea7c740cfae4df0

.exe 141KB

jaffacakes118_Virus.Win32.Sality.gen.198fb1ea7c740cfae4df0

IMPHASH 510e28b75d49708748b53d742f58037d
SHA256 224977255c6ba164ff8be3857b03018434518148cdf0034064aae2a157dce947
MD5 13eda510493198fb1ea7c740cfae4df0
SHA1 1de28e376979fd75d5b9c24bde79e7c51af6d96c
SHA512 194eabf1fa6e471d21498b8897f6189d3de9fa631fc74e1be6ae47f8d0c7d6c66f1b7ec769585ce359092858f95af9265e6762a493c1d2db80d3754e1f932ddc
SSDEEP 3072:3z83F259UoKTBfO28u1zCyVvbdU7oSiQ6S/pFO:3I3F25jKTBS3y1bG7Ri9SBFO
TLSH
T112E3E1077BF452A3C8720D7099E75A19E7727B240B609B03AB485D943DF6AD2E9313CE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

29050

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CreateDirectoryA SetFileAttributesA SetFileTime LocalFileTimeToFileTime DosDateTimeToFileTime CreateThread GetModuleFileNameW GetModuleHandleW GlobalFree GlobalAlloc LockResource LoadResource SizeofResource FindResourceW WritePrivateProfileStringW CreateFileA SetFilePointer ReadFile GetFileSize VirtualAlloc VirtualFree GetStartupInfoA GetModuleHandleA OutputDebugStringW DebugBreak lstrlenA InterlockedIncrement lstrcatW SetEnvironmentVariableW SetCurrentDirectoryW WideCharToMultiByte CreateFileW WriteFile lstrcpyW GetPrivateProfileIntW GetPrivateProfileStringW GetPrivateProfileSectionW LoadLibraryW GetProcAddress CreateProcessW WaitForSingleObject CloseHandle LocalFree FreeLibrary ExpandEnvironmentStringsW CopyFileW MoveFileExW DeleteFileW CreateDirectoryW GetVersionExW InterlockedDecrement lstrlenW GetCurrentProcess FlushInstructionCache DeleteCriticalSection HeapDestroy InitializeCriticalSection GetCurrentThreadId EnterCriticalSection LeaveCriticalSection GetCommandLineW

user32

GetDlgItem SetWindowPos CharNextW wvsprintfW wsprintfW PostMessageW LoadStringW GetWindowTextW GetClientRect SetTimer KillTimer FindWindowExW FindWindowW UpdateWindow AdjustWindowRectEx GetMenu GetWindowLongW SendMessageW LoadIconW InvalidateRect SetWindowLongW DestroyWindow DefWindowProcW IsWindow DialogBoxParamW EndDialog CreateWindowExW SetWindowTextW BeginPaint DrawTextW OffsetRect GetSysColor DrawFocusRect InflateRect GetSystemMetrics DrawEdge IsWindowEnabled EndPaint GetWindow GetTopWindow SystemParametersInfoW GetCapture CallWindowProcW SetCapture MapWindowPoints GetWindowRect ReleaseCapture GetDlgCtrlID PtInRect ClientToScreen GetParent

gdi32

SetBkMode SelectObject SetTextColor CreateFontW DeleteDC GetObjectW CreateCompatibleDC ExtTextOutW SetBkColor CreateSolidBrush DeleteObject

shell32

CommandLineToArgvW

ole32

CoUninitialize CreateStreamOnHGlobal OleInitialize OleUninitialize CoInitialize

comctl32

ImageList_Add ImageList_Create ImageList_Destroy InitCommonControlsEx ImageList_GetIconSize ImageList_Draw _TrackMouseEvent ImageList_SetImageCount

msimg32

AlphaBlend

msvcp60

?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z ?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB ??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z ?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z ?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB

wininet

InternetOpenW InternetOpenUrlW HttpQueryInfoW InternetSetOptionW InternetCloseHandle InternetReadFile

shlwapi

PathRemoveFileSpecW PathAppendW StrToIntW StrStrIW PathFileExistsW

gdiplus

GdiplusStartup GdipAlloc GdipFree GdipCreateBitmapFromStreamICM GdipCloneImage GdipDisposeImage GdipCreateHBITMAPFromBitmap GdipCreateBitmapFromStream

msvcrt

strncpy sprintf strrchr strcpy _lseek _close _write _read _open malloc _wtoi iswdigit memset wcschr _wcsicmp wcslen wcstok wcscpy wcscat _wcsnicmp free memcpy ??2@YAPAXI@Z __CxxFrameHandler _snwprintf _wtol wcscmp memcmp _except_handler3 wcsrchr _exit _XcptFilter exit _acmdln __getmainargs _initterm __setusermatherr _adjust_fdiv __p__commode __p__fmode __set_app_type _controlfp

cryptui

CryptUIWizImport

crypt32

CertCloseStore CertOpenSystemStoreW

wintrust

CryptCATAdminReleaseCatalogContext WinVerifyTrust CryptCATCatalogInfoFromContext CryptCATAdminEnumCatalogFromHash CryptCATAdminCalcHashFromFileHandle CryptCATAdminReleaseContext CryptCATAdminAcquireContext

cabinet

ord22 ord23 ord21 ord20