jaffacakes118_Virus[.]Win32[.]Sality[.]gen[.]24046c9625ce2a5f5f064177382f7e27

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Virus.Win32.Sality.gen.24046c9625ce2a5f5f064177382f7e27
Size 413KB
Sample261014-prrcfsvxdy
SHA256 3a63df661e320a43fccbd8bb15921c5030420168992208da387f0aac3da29c30
MD5 24046c9625ce2a5f5f064177382f7e27
SHA1 642ab29fead1c14b3734152404ddfde53e9e979c
SHA512 c6ade23f3f6a05a3cb44c84f4243181d1995917528e6e767c8876a548f7033538be301450cc2572f1b5cdfeb9781462d3228c497d2773ea4097eaa825b0939e8
SSDEEP 6144:rO5cb8chYFh5kCH1eJzxfo2NqidHOVOGuGvfOlTE:TRuZD9
TLSH
T10294AF6B9F578142E83C60F0C6B2C1B55BB25C633DB1C557FAD93D2E227A3827D4620A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Virus.Win32.Sality.gen.24046c9625ce2a5f5f064177382f7e27

File Explorer

jaffacakes118_Virus.Win32.Sality.gen.24046c9625ce2a5f5f064177382f7e27

.exe 413KB

jaffacakes118_Virus.Win32.Sality.gen.24046c9625ce2a5f5f064177382f7e27

IMPHASH dbee0fde96dde15601fe90405272f4a5
SHA256 3a63df661e320a43fccbd8bb15921c5030420168992208da387f0aac3da29c30
MD5 24046c9625ce2a5f5f064177382f7e27
SHA1 642ab29fead1c14b3734152404ddfde53e9e979c
SHA512 c6ade23f3f6a05a3cb44c84f4243181d1995917528e6e767c8876a548f7033538be301450cc2572f1b5cdfeb9781462d3228c497d2773ea4097eaa825b0939e8
SSDEEP 6144:rO5cb8chYFh5kCH1eJzxfo2NqidHOVOGuGvfOlTE:TRuZD9
TLSH
T10294AF6B9F578142E83C60F0C6B2C1B55BB25C633DB1C557FAD93D2E227A3827D4620A
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11475

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

u32cfg

ulcCheckLegality ulcErrMessage GetModuleInfo ulcGenerate

herdocdll

ulDocfnInitTitleMgr ??0CHerDoc@@QAE@PAUIUnknown@@@Z ?fnUrInit@CHerDoc@@SAHXZ ?GetRuntimeClass@CHerDoc@@UBEPAUCRuntimeClass@@XZ ?Serialize@CHerDoc@@UAEXAAVCArchive@@@Z ?GetMessageMap@CHerDoc@@MBEPBUAFX_MSGMAP@@XZ ?SetPathName@CHerDoc@@UAEXPBDH@Z ?IsModified@CHerDoc@@UAEHXZ ulDocfnInitFilterMgr ?DeleteContents@CHerDoc@@UAEXXZ ?OnNewDocument@CHerDoc@@UAEHXZ ?OnOpenDocument@CHerDoc@@UAEHPBD@Z ?OnSaveDocument@CHerDoc@@UAEHPBD@Z ?OnIdle@CHerDoc@@UAEXXZ ?DoSave@CHerDoc@@UAEHPBDHV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z ?ReportSaveLoadException@CHerDoc@@UBEXPBDPAVCException@@HI@Z ??1CHerDoc@@UAE@XZ ulDocfnUnInitFilterMgr ?SetModifiedFlag@CHerDoc@@UAEXH@Z ulDocfnUnInitTitleMgr ?fnUrUninit@CHerDoc@@SAHXZ

mfc80

ord2931 ord1920 ord3832 ord5382 ord6219 ord5102 ord1010 ord3806 ord5583 ord2018 ord2063 ord4326 ord6276 ord3801 ord6278 ord4014 ord4038 ord1486 ord304 ord1489 ord6118 ord299 ord6703 ord1917 ord1126 ord781 ord4270 ord4482 ord6043 ord2768 ord3040 ord4222 ord4258 ord5495 ord2742 ord5412 ord1379 ord5593 ord5157 ord2051 ord2016 ord6238 ord2621 ord2614 ord2825 ord3386 ord3035 ord976 ord5465 ord6245 ord3102 ord4921 ord3002 ord2546 ord5224 ord5603 ord1207 ord1084 ord5226 ord2248 ord3948 ord4568 ord5230 ord5213 ord5566 ord2537 ord2731 ord2835 ord4307 ord2714 ord2838 ord2540 ord2646 ord2533 ord3718 ord3719 ord3709 ord2644 ord3949 ord4481 ord4261 ord3333 ord566 ord757 ord4541 ord3683 ord762 ord5493 ord2703 ord2702 ord3201 ord380 ord784 ord3787 ord310 ord2322 ord2902 ord876 ord578 ord629 ord384 ord764 ord4027

msvcr80

_controlfp_s _invoke_watson _crt_debugger_hook ?_type_info_dtor_internal_method@type_info@@QAEXXZ ?terminate@@YAXXZ __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _configthreadlocale _initterm_e _initterm _acmdln exit _ismbblead _XcptFilter _exit _cexit __getmainargs _amsg_exit _decode_pointer _onexit _lock _encode_pointer __dllonexit _unlock _except_handler4_common atoi memset _setmbcp __CxxFrameHandler3 _mbstok _mbscmp

kernel32

InterlockedExchange GetTickCount FreeLibrary GetProcAddress LoadLibraryA GetPrivateProfileIntA FindClose FindNextFileA FindFirstFileA GetPrivateProfileStringA WinExec GetFullPathNameA GetModuleFileNameA Sleep InterlockedCompareExchange GetStartupInfoA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent QueryPerformanceCounter GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime GetACP GetThreadLocale GetLocaleInfoA GetVersionExA

user32

wvsprintfA wsprintfA

u32comm

u32GetAppIni u32GetOsVersion u32GetAppDataFolder

u32video

uVideoGetFormatIndex uVideoGetFormatInfo uVideoExit uVideoInit2

udrawingtool

gfnInitDrawingTool gfnUninitDrawingTool

u32uscui

R1 S1 T1 I X M J O L H G F E D C B N K A Q1

ufccolor

InitUFCCOLOR ExitUFCCOLOR

ufctmtg

?tmtgInit@@YAHXZ

herrc

?herGetRCInstance@@YAPAUHINSTANCE__@@XZ

drawimagemgr

UdiManagerInit UdiManagerUninit

digeneral

DiGenUninit DiGenInit

upppmgr

uppUnInit uppInit

dmfexportapi

fn_Authoring_ExportAPI_UnInit fn_Authoring_ExportAPI_Init