jaffacakes118_Virus[.]Win32[.]Sality[.]gen[.]40b0c53d40eecedbebcf0

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Virus.Win32.Sality.gen.40b0c53d40eecedbebcf0
Size 1.7MB
Sample261014-pvb2yads2t
SHA256 7ec1c28f828b8d54379c4abfa23620b138c0df23f2f4f5f4554643d5568eda91
MD5 0647f437a8740b0c53d40eecedbebcf0
SHA1 cc183984b1ac3ec83d8c86a45d3981bf193fe1ce
SHA512 880237384427608bafe04ee8931c3afccf1a6ce99d61a05e2b4b0358e39c52e09c7949b8b7b99c770d2f88bc734685084ab164c7c2413857c565d84f53334519
SSDEEP 49152:Be0vXr6+IBZ7EJkZCgUxbrjogTq72MbMKjU7:BewWDB+PTY2MbML7
TLSH
T14185F122B5D68036E5F31A35CDBAB9195AEDBE310522C65F23C44A4D1DB05A0BF3A373
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Virus.Win32.Sality.gen.40b0c53d40eecedbebcf0

File Explorer

jaffacakes118_Virus.Win32.Sality.gen.40b0c53d40eecedbebcf0

.exe 1.7MB

jaffacakes118_Virus.Win32.Sality.gen.40b0c53d40eecedbebcf0

IMPHASH b29655bf03e9c65bc67cff56c588ae44
SHA256 7ec1c28f828b8d54379c4abfa23620b138c0df23f2f4f5f4554643d5568eda91
MD5 0647f437a8740b0c53d40eecedbebcf0
SHA1 cc183984b1ac3ec83d8c86a45d3981bf193fe1ce
SHA512 880237384427608bafe04ee8931c3afccf1a6ce99d61a05e2b4b0358e39c52e09c7949b8b7b99c770d2f88bc734685084ab164c7c2413857c565d84f53334519
SSDEEP 49152:Be0vXr6+IBZ7EJkZCgUxbrjogTq72MbMKjU7:BewWDB+PTY2MbML7
TLSH
T14185F122B5D68036E5F31A35CDBAB9195AEDBE310522C65F23C44A4D1DB05A0BF3A373
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

363855

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ChromeRecoveryProbe_unsigned.pdb

advapi32

RegDeleteValueW IsTextUnicode SystemFunction036 RegisterEventSourceW DeregisterEventSource ReportEventW ImpersonateLoggedOnUser RegOpenCurrentUser TraceEvent UnregisterTraceGuids RegisterTraceGuidsW GetTraceEnableLevel GetTraceEnableFlags GetTraceLoggerHandle DuplicateTokenEx ImpersonateSelf RevertToSelf ConvertSidToStringSidW AdjustTokenPrivileges LookupPrivilegeValueW CreateProcessAsUserW FreeSid GetSecurityDescriptorSacl GetSecurityDescriptorDacl GetSecurityDescriptorGroup GetSecurityDescriptorOwner GetSecurityDescriptorControl GetLengthSid CopySid IsValidSid GetSidSubAuthority InitializeSid GetSidLengthRequired SetSecurityDescriptorDacl AddAce InitializeAcl GetAclInformation InitializeSecurityDescriptor MakeAbsoluteSD OpenProcessToken GetTokenInformation SetSecurityDescriptorOwner SetSecurityDescriptorGroup GetAce MakeSelfRelativeSD GetSecurityDescriptorLength EqualSid SetNamedSecurityInfoW ConvertStringSidToSidW RegQueryValueExW RegOpenKeyExW OpenThreadToken RegDeleteKeyW RegCloseKey RegCreateKeyExW RegSetValueExW RegEnumKeyExW RegQueryInfoKeyW RegEnumValueW GetSidIdentifierAuthority GetSidSubAuthorityCount AllocateAndInitializeSid CheckTokenMembership

kernel32

SetLastError CreateEventW Sleep TlsAlloc TlsGetValue TlsSetValue TlsFree GetTickCount InterlockedPushEntrySList RtlUnwind FreeLibrary LoadLibraryExW EncodePointer ExitProcess GetModuleHandleExW GetModuleFileNameW MultiByteToWideChar WideCharToMultiByte GetStdHandle GetACP GetCurrentThread LCMapStringW FindFirstFileExW IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW GetFileType OutputDebugStringA TerminateProcess CreateThread SetStdHandle GetStringTypeW FlushFileBuffers GetConsoleCP GetConsoleMode WriteConsoleW GetFileAttributesExW CopyFileW MoveFileExW lstrlenW GetFileTime SetFilePointer ReadFile GetFileSize CompareFileTime FileTimeToSystemTime LoadLibraryW LocalFree GetFileAttributesW WaitForMultipleObjects DuplicateHandle ReleaseMutex GetEnvironmentVariableW FormatMessageW lstrcmpW GetStringTypeExW GetLocalTime GetPrivateProfileIntW GetPrivateProfileStringW VirtualQuery GetTempPathW SystemTimeToFileTime VerifyVersionInfoW VerSetConditionMask ResetEvent LocalAlloc OpenProcess DeviceIoControl GlobalMemoryStatusEx SetPriorityClass CreateProcessW ProcessIdToSessionId GetSystemPowerStatus CreatePipe SetHandleInformation CreateMutexW InitializeCriticalSection TryEnterCriticalSection SetEvent GetLongPathNameW WaitForMultipleObjectsEx CreateToolhelp32Snapshot Process32FirstW Process32NextW ReadProcessMemory GetThreadLocale lstrcpynW GetLogicalDriveStringsW QueryDosDeviceW GlobalAlloc GlobalLock GlobalUnlock GlobalFree GetPrivateProfileSectionNamesW GetComputerNameExW GetSystemDefaultLangID GetUserDefaultLangID lstrcmpA GetStringTypeExA CreateFileMappingW MapViewOfFileEx UnmapViewOfFile GetCurrentProcess InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsProcessorFeaturePresent LeaveCriticalSection EnterCriticalSection WaitNamedPipeW TransactNamedPipe SetNamedPipeHandleState GetProcessId VirtualQueryEx RtlCaptureContext ReleaseSemaphore CreateSemaphoreW UnregisterWaitEx QueryPerformanceFrequency QueueUserWorkItem GetFileSizeEx VirtualProtect VirtualAlloc GetSystemInfo OutputDebugStringW IsDebuggerPresent InterlockedPopEntrySList FlushInstructionCache VirtualFree LoadLibraryExA GetModuleHandleW GetProcAddress GetCommandLineW GetExitCodeProcess GetTempFileNameW SetFilePointerEx CloseHandle DeleteFileW CreateFileW WaitForSingleObject RemoveDirectoryW WriteFile CreateDirectoryW lstrcmpiW GetProcessHeap DeleteCriticalSection HeapDestroy DecodePointer HeapAlloc FindResourceW LoadResource FindResourceExW RaiseException HeapReAlloc LockResource GetLastError HeapSize FindClose InitializeCriticalSectionAndSpinCount FindNextFileW HeapFree FindFirstFileW SizeofResource WaitForSingleObjectEx

ole32

CoCreateInstance CoCreateGuid IIDFromString CoTaskMemFree CoGetObject CoGetCallContext CoImpersonateClient WriteClassStm OleSaveToStream CoSetProxyBlanket CoRegisterPSClsid CoTaskMemAlloc CoTaskMemRealloc ReadClassStm StringFromGUID2 CoInitializeEx CoUninitialize CoRevertToSelf

oleaut32

SafeArrayGetUBound SafeArrayCopy SafeArrayGetVartype VariantInit VariantClear SysAllocString LoadTypeLi SafeArrayGetLBound SysStringLen LoadRegTypeLi SysAllocStringLen SysStringByteLen SafeArrayDestroy SafeArrayUnlock SysAllocStringByteLen VariantChangeType SafeArrayCreate SafeArrayRedim VarUI4FromStr SysReAllocStringLen SafeArrayLock VarBstrCmp SysFreeString

shell32

SHGetFolderLocation SHGetDesktopFolder ShellExecuteExW CommandLineToArgvW SHGetFolderPathW ord680

user32

MessageBoxW CharLowerBuffW CharUpperW CharLowerW DestroyWindow AllowSetForegroundWindow DispatchMessageW TranslateMessage PostQuitMessage GetMessageW PeekMessageW SetForegroundWindow GetWindow GetWindowLongW MonitorFromWindow GetMonitorInfoW GetWindowRect GetParent GetClientRect MapWindowPoints SetWindowPos CreateWindowExW UnregisterClassW wsprintfW wvsprintfW CharNextA CharLowerBuffA IsWindow LoadStringW CharUpperBuffW CharNextW GetWindowThreadProcessId CloseClipboard SetClipboardData EmptyClipboard OpenClipboard EnumWindows IsWindowVisible KillTimer SetTimer DefWindowProcW RegisterClassExW GetClassInfoExW LoadCursorW SetWindowLongW CallWindowProcW

netapi32

NetWkstaUserGetInfo NetWkstaGetInfo NetGetJoinInformation NetApiBufferFree

shlwapi

UrlCombineW PathAddExtensionW PathFindExtensionW StrRetToStrW PathFindFileNameW PathStripPathW PathCreateFromUrlW PathRemoveFileSpecW PathRemoveExtensionW PathCanonicalizeW PathAppendW PathCommonPrefixW SHQueryValueExW PathAddBackslashW PathIsRelativeW UrlIsW UrlEscapeW

iphlpapi

GetIfTable

msi

ord175 ord238 ord141

psapi

EnumProcessModules GetModuleFileNameExW EnumProcesses

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

userenv

UnloadUserProfile ExpandEnvironmentStringsForUserW CreateEnvironmentBlock DestroyEnvironmentBlock

wtsapi32

WTSFreeMemory WTSEnumerateSessionsW WTSQuerySessionInformationW

crypt32

CryptQueryObject CertDuplicateCertificateContext CryptHashCertificate CryptUnprotectData CertGetNameStringW CertEnumCertificatesInStore CertFreeCertificateContext CertCloseStore CryptProtectData

wintrust

WinVerifyTrust

Name

.text

Size

444KB

Virtual Size

444KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

118KB

Virtual Size

118KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

17KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

336B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

89KB

Virtual Size

92KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_Virus.Win32.Sality.gen.40b0c53d40eecedbebcf0

advapi32

kernel32

ole32

oleaut32

shell32

user32

netapi32

shlwapi

iphlpapi

msi

psapi

version

userenv

wtsapi32

crypt32

wintrust

generic