jaffacakes118_Virus[.]Win32[.]Pioneer[.]cz[.]7d8403acf965e91f7e218

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Virus.Win32.Pioneer.cz.7d8403acf965e91f7e218
Size 1.9MB
Sample261015-2ajx9set2q
SHA256 1ab92b25945a06d532326a4585cd6e7b09444cd374d165f2e10417c99a0ece8d
MD5 b306e25e2b17d8403acf965e91f7e218
SHA1 5b42e946be863877e4d4d482e9e16f63432355e9
SHA512 03ddc90b59db39bceb28af4d3c8b721fb80eeccccbddc90bc6392d2257f9e6b31a4df6708579008fe1a30217a1d105ba7935d70fa478f4656205c290d0762393
SSDEEP 24576:bk4aPlfTUYDrQOfseBC1+ZnoBzEgY5cfPtQE3WV9UKkjhmKiKSqSWLaPgIze7m2c:brU9T8ZDYWntr3WVaju4I3VGizeL+H
TLSH
T15995BE61FBCAC1F6CE4B12742065D72F9BF1832857352AE363902E8D59B72D1AC36319
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Virus.Win32.Pioneer.cz.7d8403acf965e91f7e218

File Explorer

jaffacakes118_Virus.Win32.Pioneer.cz.7d8403acf965e91f7e218

.exe 1.9MB

jaffacakes118_Virus.Win32.Pioneer.cz.7d8403acf965e91f7e218

IMPHASH 18aabd61279e6cec11a74a4209289593
SHA256 1ab92b25945a06d532326a4585cd6e7b09444cd374d165f2e10417c99a0ece8d
MD5 b306e25e2b17d8403acf965e91f7e218
SHA1 5b42e946be863877e4d4d482e9e16f63432355e9
SHA512 03ddc90b59db39bceb28af4d3c8b721fb80eeccccbddc90bc6392d2257f9e6b31a4df6708579008fe1a30217a1d105ba7935d70fa478f4656205c290d0762393
SSDEEP 24576:bk4aPlfTUYDrQOfseBC1+ZnoBzEgY5cfPtQE3WV9UKkjhmKiKSqSWLaPgIze7m2c:brU9T8ZDYWntr3WVaju4I3VGizeL+H
TLSH
T15995BE61FBCAC1F6CE4B12742065D72F9BF1832857352AE363902E8D59B72D1AC36319
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

968917

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ws2_32

gethostname connect socket gethostbyname bind getsockname recv send WSAGetLastError shutdown closesocket __WSAFDIsSet select htons inet_addr inet_ntoa ntohs ioctlsocket setsockopt WSAStartup

crypt32

CertFreeCertificateContext CertGetCertificateContextProperty CertGetSubjectCertificateFromStore CryptMsgGetParam CryptMsgClose CryptMsgUpdate CryptMsgOpenToDecode CertCloseStore CryptDecryptMessage CertOpenStore CryptSignMessage CryptEncodeObject CryptVerifyMessageSignature CryptVerifyDetachedMessageSignature CryptEncryptMessage CertDuplicateCertificateContext CertEnumCertificatesInStore CertFindCertificateInStore CertSetCertificateContextProperty CertNameToStrW CryptDecodeObject CertCreateCertificateContext CryptMsgControl

shlwapi

PathCombineA SHDeleteKeyA PathFindExtensionA

wininet

InternetOpenA InternetCloseHandle InternetOpenUrlA

kernel32

GetConsoleCP HeapSize LCMapStringW MultiByteToWideChar LCMapStringA GetModuleHandleA FindFirstFileA FindClose FindNextFileA SetErrorMode ExpandEnvironmentStringsA CopyFileA GetModuleFileNameA WaitForMultipleObjects CreateThread GetComputerNameA Sleep ExitThread GetLogicalDriveStringsA GetDriveTypeA LocalFree GetLastError SystemTimeToFileTime CompareFileTime GetConsoleMode GetSystemTime GetLocalTime FileTimeToLocalFileTime GetTickCount GetACP GetOEMCP FormatMessageA GetFullPathNameW GetFullPathNameA GetCurrentDirectoryA GetCurrentDirectoryW GetTempPathW GetTempPathA DeleteFileW DeleteFileA SetFileAttributesA SetFileAttributesW GetFileAttributesA GetFileAttributesW CreateFileA SetFilePointer CloseHandle GetFileTime ReadFile GetProcessHeap GetFileSize InitializeCriticalSection DeleteCriticalSection LeaveCriticalSection EnterCriticalSection GetTimeZoneInformation GetVersionExA CreateFileW GetProcAddress LoadLibraryA FreeLibrary RaiseException HeapAlloc GetCurrentProcessId QueryPerformanceCounter HeapFree VirtualFree HeapCreate SetStdHandle GetStringTypeA GetStringTypeW GetLocaleInfoA InitializeCriticalSectionAndSpinCount VirtualAlloc HeapReAlloc CompareStringA CompareStringW SetEnvironmentVariableA FlushFileBuffers WriteConsoleA GetConsoleOutputCP WriteConsoleW SetEndOfFile WriteFile GetCommandLineA GetStartupInfoA RtlUnwind GetSystemTimeAsFileTime TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCPInfo InterlockedIncrement InterlockedDecrement IsValidCodePage GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId ExitProcess GetStdHandle FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType

user32

DefWindowProcA TranslateMessage DispatchMessageA RegisterClassExA GetMessageA GetSysColorBrush CreateWindowExA

advapi32

CryptDestroyKey CryptExportKey CryptGetProvParam CryptEnumProvidersA CryptAcquireContextW CryptGenRandom CryptReleaseContext CryptAcquireContextA RegCreateKeyExA GetUserNameA RegCloseKey RegOpenKeyExA RegQueryValueExA RegSetValueExA CryptGetUserKey

Name

.idata

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

405KB

Virtual Size

405KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

82KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

140KB

Virtual Size

141KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

whsogrh

Size

182KB

Virtual Size

184KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_Virus.Win32.Pioneer.cz.7d8403acf965e91f7e218

ws2_32

crypt32

shlwapi

wininet

kernel32

user32

advapi32

generic