jaffacakes118_Virus[.]Win32[.]Otwycal[.]b[.]05017dcad51a58b912dee16462bc50fb

resource
jaffacakes118_Virus.Win32.Otwycal.b.05017dcad51a58b912dee16462bc50fb

jaffacakes118_Virus.Win32.Otwycal.b.05017dcad51a58b912dee16462bc50fb

IMPHASH dd1742eadfc6df18ded3c26ae64ad610
SHA256 b2efcf12f164f08e86f6a3eba0af13aaff7edd40ddc712dc9cdf39324b0c8cc9
MD5 05017dcad51a58b912dee16462bc50fb
SHA1 bdcd82e73ca46edd6b632a19d9a854984834332c
SHA512 990b561032d12a59a943f107f80c4bb2374020ca7f5418ab9cfbcee830c17f79fc685e781e49eb95c86e67f3a3942512e09f503740f5910f110f9b0efb4f68a5
SSDEEP 12288:XOzt787d+zB3WbQ4AJrp3ONWJtbZU8JFtrymB:ezt7878z5Fp32Ktb/JFwE
TLSH
T169B40232A9406477D5A6053211735FAB9F7B9E7B9431EE0F87807EA63F772D1DA22002
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

237568

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetFileSize GetModuleFileNameA GetTickCount GetCurrentProcess CopyFileA CloseHandle GetWindowsDirectoryA GetTempPathA GetCommandLineA LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess SetErrorMode GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA ExitProcess

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA CreateDialogParamA DestroyWindow SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

Name

.text

Size

23KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

151KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

�n!

Size

239KB

Virtual Size

240KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

.data

SHA256 02b7d98b2d1b2b1b72b2c8bf50a749a57884a0b6d630000a00efd2a25213f049
MD5 ca27ce2125a409c199c62220f3a490e1
SHA1 45f5dee0dda0e4177f8a5768f547234459ad9a39
SHA512 39641dc7798f26311deb49b3eb3819492ce58858c1a446e8b69abc651483375a48a490bfc9d92bbe9796cfba555ebf5bb447c21f6de2fc8f8a467e1aeb821e0c
TLSH
T16611F18697285819CA134AB46C5F193E4F02A6D2AEE16B4370DDBCF50B508229C8E961
MD5 SHA1 SHA512 TLSH

.rdata

SHA256 e0dbf218a795bb65e19287d9ac8869ae620fe12fd602d9e5466fa4405dfa72ae
MD5 cc69405d249aab53fcf2c537438bba55
SHA1 90c5e5baf7b11d1bc33e5cc277db2d6fec440f4d
SHA512 3592ab3310777508cf8fbd97f30509e8aee1c0bcf4d6faf2d78616370baa3a125e018503c93668d90bb033ffe8d155f30f7accaa98ec7da46d9b3c62ff1404ed
SSDEEP 96:73guY5WoxO8Haomsj3gu3pbQe3sPtMj2jrHiGA4lVlsdsUFmJk:73guJoxyopj3gu3pbH8PeS/iB4hsdlF8
TLSH
T12AB1C75719EA2DFFC1DB4B3620B2FFAE49BAC5D4C05A040015E895CB5F6A186816E3F2
MD5 SHA1 SHA512 SSDEEP TLSH

.rsrc/DIALOG/105

SHA256 349420ba5b5de0b0081e96a686c826e0f409f2f3413f2e9fb7e6f71cb544c325
MD5 c0c4f9be63c9d286b8d1265977ac9d86
SHA1 f9c0d915ded3ea188f342d0e5341e67701eed813
SHA512 c68d19d71f58221e6ed433d4733b2a8ba4d2411557a824c506de162def8b3a3913d1e2840576d81afe5afc0b1e6767d79b7df51d165d0d7cb87d60841daf1024
TLSH
T114F0B6595B04C826E01D4B7983E2C3D37633B0241A456A53FF8D63969950E9CFC2DA42
MD5 SHA1 SHA512 TLSH

.rsrc/DIALOG/106

SHA256 1a39a3aabdee2aa68c507c55ff37c38722b05b7f8bde66185a2462792381d8cd
MD5 8c69d2c81dd2d9050d0fa94df90ff16b
SHA1 cd71d904da747d7141e5abdde9363f7e240b26bd
SHA512 c07f491b5728a24aea2669ae0680801a1c3bc89ca9c9272b33609abcaf1f85005346ef3f7f997a314bf465ca0d4d6a05074ee4071324c77472bcbf083d58e77d
TLSH
T10BD08C0D83D0C0B0F0B00C39903AC5832A29B5824C0976CBBCDA83BB0C24E00FD72200
MD5 SHA1 SHA512 TLSH

.rsrc/DIALOG/111

SHA256 a10617b39293152a65ad5c91ca4f35135845c7b785e3a582e58f6c8229045b85
MD5 2497a44fff8b76b5129662b60a617c85
SHA1 f73bd7c9caa4c1f7a0e4840d69b0accdc6d167a0
SHA512 894e1d89007a8236dbf9042f6791143ab4c0502f914ab99304024adb73214cadbb253cc24fd6cf85e59b71de13237c855f991c60390a87760661d82c0fea1cb4
TLSH
T16CD0800539D6C908E1F52DB1E5B1E3D71332F420D530C76F76C0121D04D55008C14F45
MD5 SHA1 SHA512 TLSH

.rsrc/GROUP_ICON/103

SHA256 24624f5e9c964de610ace03e092ad78f62e9b48bdd5e1c410547a1f944b38d5f
MD5 c09ec166041d71c5b01873d10bb629b7
SHA1 47fd51078556b47b30579c5630c39121ad72f705
SHA512 47a9142fc3d6345f8047ca053d6981a400698766f54a4faf4ecbc96aaf6e8f379b3b5284d55eda91940eee349d38b356e174d2ba352a6888d44dbb5cbabb0828
TLSH
T127A0020099544046C54D4B30001B12249415903601B12709044900580E566589DB4494
MD5 SHA1 SHA512 TLSH

.rsrc/ICON/1.ico

SHA256 6e80d06c8ec367e006eddc4f1b07083ea657d41e59fc6b08985b34060725c40c
MD5 c71d2c01a6ccf55895c4ef7c9487e2f7
SHA1 7801cbb8d8286e32f81e4c1e63ee198c2ccf8f46
SHA512 afbc235281753a3796aa908f01f799732eeb165ac7cfb59913c9aab27b0bc69a504b7ef2d2c954f0a570414eb35c144deb028175e217e0bce9fa0e3daf027285
TLSH
T1EDE01707B228F984C308A1309913AFE60D203C02AC544B56F7B09A5E3EB829494424F8
MD5 SHA1 SHA512 TLSH

.rsrc/ICON/2.ico

SHA256 90c2217bbaa9f8330b5b9f7c4543584ec9732cb1a08d09514ce9b7f1ccb6254b
MD5 f885036f317a07578f65e835e5d27841
SHA1 a122e0940efa2561e9ac329c3d6c70f658b08853
SHA512 521b0708daf2a0308bc1f8fc26eb39307a69a7b779fa41bbbe7131064c3ce384d1bc2d193e41f7f12d06878b62aac68e1fb6f59894fc8add416903f7fb0f7012
TLSH
T15C21B22616118884EA94CC36458BDC5C0524F91B905E7D8877C05DAF2E17CEED67315F
MD5 SHA1 SHA512 TLSH

.rsrc/ICON/3.ico

SHA256 f97ab49aff7485d4db47e398a787cde574a5f5e90d8f117519a47151325c0606
MD5 24af02bb07ad67bc409945d508e883fc
SHA1 9af962610a95f2e03080ce6e715b8c83cc344675
SHA512 84b5a7390f885b787f1e84e4bf41a65f2b8372df22da8d9da319e37ce10de9270bfa381363d272bb168cab54177d6af5a1ee482c534138d9105c650726a14099
TLSH
T14801DB1EB682DAD9E40847318C73D7E54D3D2C292D34053E67A05F1F2DB164128970FC
MD5 SHA1 SHA512 TLSH

.rsrc/ICON/4.ico

SHA256 0a6bf7333307005f3f16f4055b254a423e80ca683a3713303b3a45f9dbc3e425
MD5 7271c08c0b0c6eef544b893db3cda8fd
SHA1 1072cebd52b2c10ea5c9c44fcef162c1c7c09400
SHA512 2e5723410d1e0fee1995a5f4a80beff51c19d4cda3ce198ace69fc9ced3b61da4dfc9c4ebf530453eb5ea16cd949784dc9799eb2de578f8037490bf117400ac6
TLSH
T146414822C2204C8CE5A09C72468FD97D0029FC17D03E7A942BC43D079E7BDFED62599A
MD5 SHA1 SHA512 TLSH

.rsrc/MANIFEST/1

SHA256 b287a2bda6915516b0ba92a040618caf14625620b17de1c8c3bc984907d2f2af
MD5 4595a1f3120e4b99bde6d8aff7e3b9bb
SHA1 d189f6e840c1ac72d7844a59d85518f02884fbed
SHA512 a31c2972f504ac80d7603527de231c17e5e72f110adb97bf0689ff9474bf279cadd0189d2a8bce89e82858b8f0fbd9b30e37384168d7e4eb9f3560910ebb484e
TLSH
T1BAF08B00D080FD3AAB2206A13FDDF41123AD933305CC469D48E2E8AA9B4B6CA06011A2
MD5 SHA1 SHA512 TLSH

.rsrc/version.txt

SHA256 138df11c565ec6558f4a0031d1bce82d9c89bec01ec67314823940d368d7675a
MD5 3e0ef94c1f32c88dbc361be17ff0c348
SHA1 7ed3b1d13b10e16d2fb75ac051aa3fe4356aad19
SHA512 d9516b538297b538ec81719f4712d39e090427114df9c6a8f4d8fa4ea0455531c136c158081ac592ba43f680cd7ccdfad94394408cb33f87cac28a5ffed98fb9
TLSH
T130218C0A92FB36D8A0A7A98D5EDACC3203977910053D965E98CC7F4D0FD38051512BF7
MD5 SHA1 SHA512 TLSH

.text

SHA256 d792d2c0c25d079c2921b93c0ffe27fda982404b580fef0248ba8ed0b9720803
MD5 b71f2a9a2f9b277fd0634b32bd35ce2a
SHA1 8bcaf8f56613f7f4ea19c21756768226dcb2aae3
SHA512 c78b2743ca08721d2c8041c0b8a71eeb5dcbb4d84db1b7e270a94115a31176437f1ba667658e0f71116087d9cc9dadf18b60768545d001628f289bb1dd4d550e
SSDEEP 384:vAHRqqzRVnqpaEBgVXPREsgmzpgnm/q5ATFDWZonPYfFmHarY0+yLZwRTsXdmxTY:vcq8R0EEBglRiupgRSTFDWZAPUmiWRgJ
TLSH
T1FDB28D6679D0D8B3FAE288B00A757779F3FF871911226E470B281F7929214978B0E54B
MD5 SHA1 SHA512 SSDEEP TLSH

[0]

SHA256 0b20e247f002c354518dc21941d8caf8501b37383550eabbdbb3aea1dcad7f16
MD5 866ccfa56ee40a01b90275ce76a19057
SHA1 545d3b20cbcd1a5623c6993eef0f96c7f3c39058
SHA512 c93d0b1a24241b422a17ef7b48998f5e774257a0b7c9d9a90ff30f4d1a3e0aca3e01080f9fdca35986eebbefe09972ab17c0cbab083e2c119717ecf96051edb6
SSDEEP 6144:Tt7WiO7KlxEiaNXcBJ/nzpzSC3Wbx2i+y6:Tt787d+zB3WbQ
TLSH
T1FA34E17669017033C5A5017762229FAB8EAB5FBF5034EE0FDA447E69377B2D2DB21402
MD5 SHA1 SHA512 SSDEEP TLSH

n!

SHA256 11780e0789eb9b98703b0f18847c0f21b65ec80f7d95df5912dada11bf03bfc6
MD5 2bd03b7dda435888e99d6bcfa1fb2858
SHA1 01db10dcc45d44b1302cbad05447923283bfb6d0
SHA512 6dc90836a844a410ca9c003a61d9f879cd4aeccec89ab9518bc149f1c2ddde34c93c35364798c343ad9f55b869e077f0b3d06d44267be7c4941f8f722470ecbf
SSDEEP 6144:yAJrfB3+pLeFOqLVJ5bbZXegqw48gyH0YtnbvK/kFZj:yAJrp3ONWJtbZU8JFtrymB
TLSH
T12D3413226C184E99F9A7673590730E87632FAD81EC32EF1DC590ACD27E773617863806
MD5 SHA1 SHA512 SSDEEP TLSH

Sharing

General

Malware Config

Signatures

File Explorer