jaffacakes118_Trojan[.]Win32[.]Agent[.]qwglgk[.]5639ede3fff95b63490ad062a694209a

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan.Win32.Agent.qwglgk.5639ede3fff95b63490ad062a694209a
Size 821KB
Sample261015-296ajsys4q
SHA256 42259f620de33f4271bd4a2c1cad7f21631c56034b5e0fd65a5a9609df74aecc
MD5 5639ede3fff95b63490ad062a694209a
SHA1 d2f8b46be47336ea1bd13882b68db80357493cd6
SHA512 d9b13008be8ae9fc86c9480c793e4b52c54fac9ed63c0ff1e72a08c1a83e93d89be749f2499d4f6224d8def13fb8146f94f8053439318b8f591f2a614980ab55
SSDEEP 24576:IKcy8DNOozVsceh5KwvxqIcGg+uxfEuPAsSLWCBFWp:IKLWtqchw0GYxF
TLSH
T159051203B6D48136CD7513F449F90AD30A7ABDE24F7C928F2345659B4CB22C4A972B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan.Win32.Agent.qwglgk.5639ede3fff95b63490ad062a694209a

File Explorer

jaffacakes118_Trojan.Win32.Agent.qwglgk.5639ede3fff95b63490ad062a694209a

.exe 821KB

jaffacakes118_Trojan.Win32.Agent.qwglgk.5639ede3fff95b63490ad062a694209a

IMPHASH bc70c4fa605f17c85050b7c7b6d42e44
SHA256 42259f620de33f4271bd4a2c1cad7f21631c56034b5e0fd65a5a9609df74aecc
MD5 5639ede3fff95b63490ad062a694209a
SHA1 d2f8b46be47336ea1bd13882b68db80357493cd6
SHA512 d9b13008be8ae9fc86c9480c793e4b52c54fac9ed63c0ff1e72a08c1a83e93d89be749f2499d4f6224d8def13fb8146f94f8053439318b8f591f2a614980ab55
SSDEEP 24576:IKcy8DNOozVsceh5KwvxqIcGg+uxfEuPAsSLWCBFWp:IKLWtqchw0GYxF
TLSH
T159051203B6D48136CD7513F449F90AD30A7ABDE24F7C928F2345659B4CB22C4A972B6B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

27088

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

wextract.pdb

advapi32

OpenProcessToken GetTokenInformation RegSetValueExA EqualSid RegQueryValueExA LookupPrivilegeValueA RegCreateKeyExA RegOpenKeyExA RegQueryInfoKeyA RegDeleteValueA AllocateAndInitializeSid FreeSid AdjustTokenPrivileges RegCloseKey

kernel32

GetPrivateProfileIntA GetFileAttributesA IsDBCSLeadByte GetSystemDirectoryA GlobalUnlock GetShortPathNameA CreateDirectoryA FindFirstFileA GetLastError GetProcAddress RemoveDirectoryA SetFileAttributesA GlobalFree FindClose GetPrivateProfileStringA LoadLibraryA LocalAlloc WritePrivateProfileStringA GetModuleFileNameA FindNextFileA CompareStringA _lopen CloseHandle LocalFree DeleteFileA ExitProcess DosDateTimeToFileTime CreateFileA FindResourceA GlobalAlloc ExpandEnvironmentStringsA LoadResource WaitForSingleObject SetEvent GetModuleHandleW FormatMessageA SetFileTime WriteFile GetDriveTypeA GetVolumeInformationA TerminateThread SizeofResource CreateEventA GetExitCodeProcess CreateProcessA _llseek SetCurrentDirectoryA GetTempFileNameA ResetEvent LockResource GetSystemInfo LoadLibraryExA CreateMutexA GetCurrentDirectoryA GetVersionExA GetVersion GetTempPathA CreateThread LocalFileTimeToFileTime SetFilePointer GetWindowsDirectoryA lstrcmpA _lclose GlobalLock GetCurrentProcess FreeResource FreeLibrary Sleep GetStartupInfoA UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess OutputDebugStringA RtlUnwind GetModuleHandleA QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime GetTickCount EnumResourceLanguagesA MulDiv GetDiskFreeSpaceA ReadFile

gdi32

GetDeviceCaps

user32

GetDC SendMessageA SetForegroundWindow MsgWaitForMultipleObjects SendDlgItemMessageA GetWindowRect MessageBoxA GetWindowLongA PeekMessageA ReleaseDC GetDlgItem SetWindowPos ShowWindow DispatchMessageA SetWindowTextA EnableWindow CallWindowProcA DialogBoxIndirectParamA GetDlgItemTextA LoadStringA MessageBeep CharUpperA CharNextA ExitWindowsEx CharPrevA EndDialog GetDesktopWindow SetDlgItemTextA SetWindowLongA GetSystemMetrics

msvcrt

memset ?terminate@@YAXXZ _controlfp memcpy _ismbblead __p__fmode _cexit _exit exit __set_app_type __getmainargs _acmdln _initterm _amsg_exit __p__commode _XcptFilter _errno _vsnprintf __setusermatherr

comctl32

ord17

cabinet

ord22 ord23 ord21 ord20

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA