jaffacakes118_Virus[.]Win32[.]Sality[.]gen[.]84c38c5bd767ca3b59d70

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Virus.Win32.Sality.gen.84c38c5bd767ca3b59d70
Size 556KB
Sample261014-pyb64sc13q
SHA256 1038e45e7d63ed6ac87957580354a5fcd32e36d6d96f2e8f6a5eedd3ed910acd
MD5 08dab9ded3f84c38c5bd767ca3b59d70
SHA1 0d71bef23784ebfa0296e90495291ef4bee94aea
SHA512 f933c54632e897add13a09091dd61be91b9cc35592c3e81c34dd41e374d90d6c7f66294b344b2fa5dbc137784be943cc0e698122f62221f772ec2d35b506d3ea
SSDEEP 6144:RIKbWzD6PvYzErIaWdGs6R54p7Z+/z9B4pfn0TRBR/acvctUOu3Hs+UrRx9LhR:Bb+52Ia+GFS+LPTnIn+K+UrRbFR
TLSH
T1F5C48E02FAD64477D5A8137018F62B3B2775AC200A3559E7F794AD7C1C712A1AB3A32F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Virus.Win32.Sality.gen.84c38c5bd767ca3b59d70

File Explorer

jaffacakes118_Virus.Win32.Sality.gen.84c38c5bd767ca3b59d70

.exe 556KB

jaffacakes118_Virus.Win32.Sality.gen.84c38c5bd767ca3b59d70

IMPHASH 4ee97ec165d270cb7406c372d71f9717
SHA256 1038e45e7d63ed6ac87957580354a5fcd32e36d6d96f2e8f6a5eedd3ed910acd
MD5 08dab9ded3f84c38c5bd767ca3b59d70
SHA1 0d71bef23784ebfa0296e90495291ef4bee94aea
SHA512 f933c54632e897add13a09091dd61be91b9cc35592c3e81c34dd41e374d90d6c7f66294b344b2fa5dbc137784be943cc0e698122f62221f772ec2d35b506d3ea
SSDEEP 6144:RIKbWzD6PvYzErIaWdGs6R54p7Z+/z9B4pfn0TRBR/acvctUOu3Hs+UrRx9LhR:Bb+52Ia+GFS+LPTnIn+K+UrRbFR
TLSH
T1F5C48E02FAD64477D5A8137018F62B3B2775AC200A3559E7F794AD7C1C712A1AB3A32F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

57353

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

user32

wvsprintfA LoadStringA wsprintfA MessageBoxA SendNotifyMessageA

winspool.drv

EnumPrintersA ClosePrinter SetPrinterA GetPrinterA OpenPrinterA EnumPortsA DeletePrinter AddMonitorA GetPrintProcessorDirectoryA DeletePrintProcessorA DeletePrinterDriverA DeleteMonitorA EnumPrinterDriversA GetPrinterDriverDirectoryA AddPrinterA AddPrintProcessorA AddPrinterDriverA

advapi32

RegEnumKeyExA RegSetValueExA RegDeleteKeyA RegEnumKeyA RegEnumValueA RegCloseKey RegOpenKeyExA RegQueryValueExA RegDeleteValueA RegCreateKeyExA

shell32

SHGetSpecialFolderLocation SHGetMalloc SHGetPathFromIDListA

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

gdi32

UpdateICMRegKeyA

kernel32

WriteFile LockResource FreeResource FlushFileBuffers ReadFile SetStdHandle GetOEMCP GetACP GetCPInfo GetStringTypeW GetStringTypeA IsBadCodePtr IsBadReadPtr SetFilePointer IsBadWritePtr VirtualAlloc VirtualFree HeapCreate MultiByteToWideChar GetComputerNameA GetEnvironmentStrings FreeEnvironmentStringsW GetCurrentDirectoryA FreeEnvironmentStringsA WideCharToMultiByte GetFileType GetStdHandle SetHandleCount GetEnvironmentStringsW UnhandledExceptionFilter LCMapStringW FreeLibrary GetProcAddress GetLastError LoadLibraryA GetExitCodeProcess WaitForSingleObject CreateProcessA GlobalFree GlobalAlloc LocalFree FormatMessageA CloseHandle CreateFileA DeleteFileA CopyFileA FindClose SetFileAttributesA GetFileAttributesA FindFirstFileA lstrcatA lstrcpyA GetTempPathA LCMapStringA GetTimeFormatA GetLocalTime SetCurrentDirectoryA TerminateProcess HeapSize WritePrivateProfileSectionA HeapDestroy GetEnvironmentVariableA LoadResource SizeofResource FindResourceA GetModuleFileNameA lstrlenA GetTempFileNameA RemoveDirectoryA GetShortPathNameA GetSystemDirectoryA CompareFileTime GetFileTime GetVersionExA GetWindowsDirectoryA GetStartupInfoA GetPrivateProfileSectionA GetProfileStringA WriteProfileStringA GetCurrentProcess RtlUnwind RaiseException GetModuleHandleA GetCommandLineA GetVersion ExitProcess HeapFree SetUnhandledExceptionFilter HeapAlloc HeapReAlloc