jaffacakes118_not-a-virus[.]AdWare[.]MSIL[.]DomaIQ[.]ajzi[.]2344e07d148f9c839c2bcd5361a315be

General

Target
jaffacakes118_not-a-virus.AdWare.MSIL.DomaIQ.ajzi.2344e07d148f9c839c2bcd5361a315be
Size 367KB
Sample261014-qthnrssx4k
SHA256 09b489bf9497bf5c125ece143bdfa6ac46f2b92cbde4c7d3d08d468e78808723
MD5 2344e07d148f9c839c2bcd5361a315be
SHA1 1c452096e3739ebb7e7cca23f65dd6bf51af25ed
SHA512 0d96670b814bd627277775a38bd8e605cc7340da6c8ca02ef4cad30c9f8c225f21fe06b12198b03dbe255fb42fb434eb6d6469993581eeff06e51d961ac84c0e
SSDEEP 6144:kGkORa/mgnbMay+9Cq6S4XbuzkWYrk4T7CkOzxQmafsQQqwb+OMJhYnc:kOmmgnby+L6TU+w4T7sxQmafsQQIGc
TLSH
T10B848C2A33D4D967D96F4FB59062466197B197A3E297F3C72D9838EE0DE13804A036C3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_not-a-virus.AdWare.MSIL.DomaIQ.ajzi.2344e07d148f9c839c2bcd5361a315be

File Explorer

jaffacakes118_not-a-virus.AdWare.MSIL.DomaIQ.ajzi.2344e07d148f9c839c2bcd5361a315be

.exe 367KB

jaffacakes118_not-a-virus.AdWare.MSIL.DomaIQ.ajzi.2344e07d148f9c839c2bcd5361a315be

IMPHASH 7d6c7d7568076064bb859f4a80f7856a
SHA256 09b489bf9497bf5c125ece143bdfa6ac46f2b92cbde4c7d3d08d468e78808723
MD5 2344e07d148f9c839c2bcd5361a315be
SHA1 1c452096e3739ebb7e7cca23f65dd6bf51af25ed
SHA512 0d96670b814bd627277775a38bd8e605cc7340da6c8ca02ef4cad30c9f8c225f21fe06b12198b03dbe255fb42fb434eb6d6469993581eeff06e51d961ac84c0e
SSDEEP 6144:kGkORa/mgnbMay+9Cq6S4XbuzkWYrk4T7CkOzxQmafsQQqwb+OMJhYnc:kOmmgnby+L6TU+w4T7sxQmafsQQIGc
TLSH
T10B848C2A33D4D967D96F4FB59062466197B197A3E297F3C72D9838EE0DE13804A036C3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

13062

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\stout.pdb

kernel32

MapViewOfFile CreateFileMappingW CreateFileW GetTempFileNameW GetTempPathW UnmapViewOfFile LockResource LoadResource FindResourceW GetModuleHandleW SizeofResource CloseHandle WriteConsoleW ReadFile RaiseException RtlUnwind EncodePointer DecodePointer GetCommandLineW HeapSetInformation GetStartupInfoW GetLastError HeapFree HeapAlloc IsProcessorFeaturePresent TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement GetProcAddress EnterCriticalSection LeaveCriticalSection Sleep HeapSize ExitProcess WriteFile GetStdHandle GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetCPInfo GetACP GetOEMCP IsValidCodePage WideCharToMultiByte HeapReAlloc LoadLibraryW LCMapStringW MultiByteToWideChar GetStringTypeW GetConsoleCP GetConsoleMode FlushFileBuffers SetFilePointer SetStdHandle

advapi32

RegOpenKeyExW

mscoree

CorBindToRuntimeEx

Sharing