jaffacakes118_Trojan[.]Win32[.]Agent[.]qwgixc[.]8c706c03e02b996cb2083812eb380377

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan.Win32.Agent.qwgixc.8c706c03e02b996cb2083812eb380377
Size 1.0MB
Sample261015-29pb2aef66
SHA256 1955b63fc79e1a8e6aea3ddb00bc57a3aa3f2ff9a6edcfb16eb5eb46efdf144e
MD5 8c706c03e02b996cb2083812eb380377
SHA1 d78e66492a98e03d6106e50babd19d493bb61fba
SHA512 6ab15d355a8c21fdf656d8356f47133420ec173e7eff0fc58c32e113b86939608a910849625cc0e2a525936586c5f8f3da2bf5a466789943230c2832ba34f06d
SSDEEP 12288:yPxo8jVvb1vs0i31Oqenh/oZPFGsaA5TGzUiTV+tOEQQaefVc9v6LAoNEO:yPxo8RhXi31qnf4UfToZc6LAom
TLSH
T129358E12779080B6E4BE033494B74F3197BEB9726B758BCBA784065D1D723C0AE35B26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan.Win32.Agent.qwgixc.8c706c03e02b996cb2083812eb380377

File Explorer

jaffacakes118_Trojan.Win32.Agent.qwgixc.8c706c03e02b996cb2083812eb380377

.exe 1.0MB

jaffacakes118_Trojan.Win32.Agent.qwgixc.8c706c03e02b996cb2083812eb380377

IMPHASH 710f68b487092cc63f1bd64a31cf7234
SHA256 1955b63fc79e1a8e6aea3ddb00bc57a3aa3f2ff9a6edcfb16eb5eb46efdf144e
MD5 8c706c03e02b996cb2083812eb380377
SHA1 d78e66492a98e03d6106e50babd19d493bb61fba
SHA512 6ab15d355a8c21fdf656d8356f47133420ec173e7eff0fc58c32e113b86939608a910849625cc0e2a525936586c5f8f3da2bf5a466789943230c2832ba34f06d
SSDEEP 12288:yPxo8jVvb1vs0i31Oqenh/oZPFGsaA5TGzUiTV+tOEQQaefVc9v6LAoNEO:yPxo8RhXi31qnf4UfToZc6LAom
TLSH
T129358E12779080B6E4BE033494B74F3197BEB9726B758BCBA784065D1D723C0AE35B26
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

24137

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

mfc110

ord7753 ord1978 ord11766 ord11765 ord14201 ord12307 ord7811 ord14401 ord6192 ord14403 ord6194 ord14402 ord6193 ord987 ord6694 ord3786 ord5765 ord12020 ord8025 ord12032 ord12720 ord14327 ord7734 ord14329 ord12317 ord12318 ord2430 ord10175 ord5212 ord8130 ord4519 ord12638 ord12701 ord10228 ord12028 ord2353 ord8191 ord1459 ord12000 ord5107 ord4023 ord9203 ord7470 ord8273 ord2149 ord5404 ord5614 ord9155 ord5380 ord5617 ord5110 ord5266 ord5091 ord7537 ord7538 ord7528 ord5264 ord8027 ord10047 ord9016 ord2189 ord8270 ord4746 ord8166 ord12658 ord2931 ord5769 ord1520 ord1517 ord1038 ord310 ord305 ord316 ord2950 ord14059 ord12336 ord5732 ord4977 ord1652 ord265 ord1498 ord4084 ord1500

msvcr110

sprintf atol free _getpid ??0exception@std@@QAE@XZ ??0exception@std@@QAE@ABV01@@Z ??1exception@std@@UAE@XZ _CxxThrowException __CxxFrameHandler3 __argv _lock _unlock _calloc_crt __dllonexit _onexit ??1type_info@@UAE@XZ _XcptFilter __crtGetShowWindowMode _amsg_exit __getmainargs __set_app_type exit _exit _cexit _ismbblead _configthreadlocale __setusermatherr _initterm_e _initterm _acmdln _fmode _commode ?terminate@@YAXXZ _except_handler4_common _crt_debugger_hook __crtUnhandledException __crtTerminateProcess __crtSetUnhandledExceptionFilter _invoke_watson _controlfp_s _setmbcp _stricmp memmove strlen strcat strcpy memset memcpy_s memcpy memcmp memchr toupper srand rand ??0exception@std@@QAE@ABQBDH@Z ?what@exception@std@@UBEPBDXZ malloc _purecall

kernel32

GetShortPathNameA SizeofResource LoadResource GetProcAddress GetModuleHandleA GetModuleFileNameA GetVersionExA GetWindowsDirectoryA OpenProcess CreateProcessA TerminateProcess GetCurrentProcessId GetCurrentProcess Sleep WaitForSingleObject CreatePipe CloseHandle WriteFile SetFileAttributesA ReadFile SetThreadAffinityMask lstrcatA GetTickCount GetCurrentThread QueryPerformanceFrequency TlsFree TlsAlloc CreateEventA CreateMutexA CreateFileA LoadLibraryA GetStartupInfoA FindResourceA CopyFileA CreateToolhelp32Snapshot Process32First Process32Next EncodePointer DeleteFileA DecodePointer IsDebuggerPresent IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime

user32

GetCursorPos

shell32

SHGetSpecialFolderPathA ShellExecuteA

shlwapi

PathFileExistsA

ole32

CoCreateGuid

urlmon

ObtainUserAgentString

wininet

InternetOpenA InternetConnectA HttpOpenRequestA HttpSendRequestA InternetCloseHandle

msvcp110

?_Winerror_map@std@@YAPBDH@Z ?_Syserror_map@std@@YAPBDH@Z ?_Xout_of_range@std@@YAXPBD@Z ?_Xlength_error@std@@YAXPBD@Z ?_Xbad_alloc@std@@YAXXZ ?set_new_handler@std@@YAP6AXXZP6AXXZ@Z

iphlpapi

GetAdaptersInfo

imagehlp

MakeSureDirectoryPathExists

psapi

EnumProcessModules GetModuleFileNameExA