jaffacakes118_Trojan[.]Win32[.]BitMiner[.]bfj[.]e6a2596eaae19e111de1c4ba5ae7a8ca

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan.Win32.BitMiner.bfj.e6a2596eaae19e111de1c4ba5ae7a8ca
Size 2.1MB
Sample261015-1cv8msed39
SHA256 b74d0ecd4aa14647beae8f92df09d52965e6a8bc3aaa7356d879fe7f9d2e6876
MD5 e6a2596eaae19e111de1c4ba5ae7a8ca
SHA1 2ffc362361397a2d656a4669b20d57ab47e146a9
SHA512 1b01281ed190975fa4afd3502c2f74177fa9578fdb2b9d8f81ffd72b0397c8b0f58d1388bf8e6e0d627ebb4fc6e7b0d28e1c710108d08e9959fc5462dbddf918
SSDEEP 49152:indf3VFzIhuI7TpiP3HplOhWpX0q5VWy7EeNLvg:i93DGaP3HplOhWFPtQALo
TLSH
T1D8A5D0117281C03EF4BB50F2C9BE8AAE48996F511B5921FB63C40E5E5F714E2AE3251F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan.Win32.BitMiner.bfj.e6a2596eaae19e111de1c4ba5ae7a8ca

File Explorer

jaffacakes118_Trojan.Win32.BitMiner.bfj.e6a2596eaae19e111de1c4ba5ae7a8ca

.exe 2.1MB

jaffacakes118_Trojan.Win32.BitMiner.bfj.e6a2596eaae19e111de1c4ba5ae7a8ca

IMPHASH 5beb291ae6544664f7c8c89434aaa3fa
SHA256 b74d0ecd4aa14647beae8f92df09d52965e6a8bc3aaa7356d879fe7f9d2e6876
MD5 e6a2596eaae19e111de1c4ba5ae7a8ca
SHA1 2ffc362361397a2d656a4669b20d57ab47e146a9
SHA512 1b01281ed190975fa4afd3502c2f74177fa9578fdb2b9d8f81ffd72b0397c8b0f58d1388bf8e6e0d627ebb4fc6e7b0d28e1c710108d08e9959fc5462dbddf918
SSDEEP 49152:indf3VFzIhuI7TpiP3HplOhWpX0q5VWy7EeNLvg:i93DGaP3HplOhWFPtQALo
TLSH
T1D8A5D0117281C03EF4BB50F2C9BE8AAE48996F511B5921FB63C40E5E5F714E2AE3251F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1063146

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\chighserver-xmr 20180128\Release\xmr.pdb

kernel32

EnterCriticalSection VirtualProtectEx GetLastError CreateMutexA ContinueDebugEvent ResumeThread OutputDebugStringA OutputDebugStringW SetThreadContext GetThreadContext WaitForDebugEvent WriteProcessMemory UnmapViewOfFile InitializeCriticalSection FreeConsole CreateThread SuspendThread DebugActiveProcess SetEnvironmentVariableA GetCurrentProcessId MapViewOfFile DuplicateHandle GetCurrentProcess CreateFileMappingA GetVersionExA GetProcAddress LoadLibraryA GetEnvironmentVariableA VirtualProtect VirtualAlloc SetLastError ReleaseMutex WaitForSingleObject OpenMutexA SetErrorMode GetShortPathNameA GetModuleFileNameA GetShortPathNameW GetModuleFileNameW GlobalUnlock GlobalLock GlobalAlloc WideCharToMultiByte IsBadReadPtr GlobalAddAtomA GlobalAddAtomW GlobalFree GlobalGetAtomNameA GlobalDeleteAtom GlobalGetAtomNameW SetFilePointer CreateFileA ExitProcess GetLocalTime MultiByteToWideChar SearchPathA GetTempPathA GetTempPathW GetTempFileNameA GetTempFileNameW GetWindowsDirectoryA ReadProcessMemory WritePrivateProfileStringA DeleteFileA MoveFileA CreateProcessA GetStartupInfoA GetCurrentThreadId ReadFile GetFileSize GetProcessHeap WriteConsoleW SetStdHandle FlushFileBuffers GetConsoleMode GetConsoleCP HeapReAlloc GetStringTypeW IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetTimeZoneInformation LoadLibraryW FreeLibrary SetConsoleCtrlHandler FatalAppExitA IsValidCodePage GetOEMCP GetACP IsProcessorFeaturePresent QueryPerformanceCounter HeapDestroy HeapCreate GetStartupInfoW GetFileType InitializeCriticalSectionAndSpinCount SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW HeapSize GetLocaleInfoW GetStdHandle CompareStringW WriteFile TlsFree TlsSetValue TlsGetValue TlsAlloc TerminateProcess IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo LCMapStringW HeapAlloc GetDateFormatA GetTimeFormatA GetModuleHandleW HeapFree GetSystemTimeAsFileTime RaiseException RtlUnwind LeaveCriticalSection GetExitCodeProcess GetCurrentThread SetThreadPriority Sleep GetTickCount VirtualQueryEx CreateEventA CloseHandle GetModuleHandleA SetEvent GetCommandLineA GetPrivateProfileStringA GetCommandLineW FormatMessageA LocalFree InterlockedIncrement InterlockedDecrement InterlockedCompareExchange InterlockedExchange DeleteCriticalSection SetEndOfFile SetFilePointerEx CreateFileW FindClose RemoveDirectoryW DeleteFileW DeviceIoControl GetFullPathNameW FindFirstFileW FindNextFileW GetFileAttributesW CreateDirectoryExW CopyFileW GetCurrentDirectoryW SetCurrentDirectoryW GetFileInformationByHandle GetFileAttributesExW GetFileTime SetFileTime MoveFileExW GetDiskFreeSpaceExW CreateDirectoryW AreFileApisANSI

user32

BeginPaint EndPaint KillTimer GetAsyncKeyState DefDlgProcA DrawTextA CreateDialogParamA RegisterClassExA DialogBoxParamA GetWindowTextLengthA GetWindowTextA SetWindowTextA GetDlgItem CreateDialogIndirectParamA ShowWindow UpdateWindow InSendMessage UnpackDDElParam DefWindowProcW DefWindowProcA LoadCursorA RegisterClassW CreateWindowExW RegisterClassA CreateWindowExA GetWindowThreadProcessId SendMessageW PeekMessageA EnumWindows IsWindowUnicode PackDDElParam PostMessageW PostMessageA IsWindow LoadStringA LoadStringW FindWindowA DestroyWindow GetDesktopWindow GetSystemMetrics MoveWindow MessageBoxA SendMessageA SetPropA EnumThreadWindows GetPropA WaitForInputIdle SetTimer GetMessageA TranslateMessage DispatchMessageA FreeDDElParam

gdi32

SelectObject BitBlt DeleteObject CreatePalette CreateDCA SelectPalette RealizePalette CreateDIBitmap DeleteDC CreateCompatibleDC

comdlg32

GetOpenFileNameA GetSaveFileNameA

shell32

SHGetSpecialFolderPathA

Name

.text

Size

Virtual Size

426KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

112KB

Virtual Size

111KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.text1

Size

752KB

Virtual Size

768KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.adata

Size

52KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data1

Size

132KB

Virtual Size

192KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc1

Size

40KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.pdata

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_Trojan.Win32.BitMiner.bfj.e6a2596eaae19e111de1c4ba5ae7a8ca

kernel32

user32

gdi32

comdlg32

shell32

generic