jaffacakes118_Virus[.]Win32[.]Sality[.]gen[.]6b3fdfaf14883e6ecef70

General

Target
jaffacakes118_Virus.Win32.Sality.gen.6b3fdfaf14883e6ecef70
Size 138KB
Sample261015-2bc64set2r
SHA256 303b8d30c5f0fb54584c65a4f98cfd155ce4cab2b331833225b4fa5f24b8df5b
MD5 39d23f516526b3fdfaf14883e6ecef70
SHA1 cadb884d5ece0fbaae569065dbb9124cc42b12f4
SHA512 296f0a6cdab6d880953629c09da9ea11b13acf3c129de6b3479899c1b5cc416ff5dabf1260995fa84f9c7a82543ea76ecbf64eb77150146264d620f4eedfd32a
SSDEEP 3072:jIIsr6l9fzYgxryw2DFX5n2C9b5MwHxfaV:lsiLHr652C9N5Rfi
TLSH
T1A8D3E0137AE68473FD45577045AA8607AF33BA000BB595DB4F98094FDEA23D06B3E392
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Virus.Win32.Sality.gen.6b3fdfaf14883e6ecef70

File Explorer

jaffacakes118_Virus.Win32.Sality.gen.6b3fdfaf14883e6ecef70

.exe 138KB

jaffacakes118_Virus.Win32.Sality.gen.6b3fdfaf14883e6ecef70

IMPHASH 79be775e9d781372135cfa16b9162b7c
SHA256 303b8d30c5f0fb54584c65a4f98cfd155ce4cab2b331833225b4fa5f24b8df5b
MD5 39d23f516526b3fdfaf14883e6ecef70
SHA1 cadb884d5ece0fbaae569065dbb9124cc42b12f4
SHA512 296f0a6cdab6d880953629c09da9ea11b13acf3c129de6b3479899c1b5cc416ff5dabf1260995fa84f9c7a82543ea76ecbf64eb77150146264d620f4eedfd32a
SSDEEP 3072:jIIsr6l9fzYgxryw2DFX5n2C9b5MwHxfaV:lsiLHr652C9N5Rfi
TLSH
T1A8D3E0137AE68473FD45577045AA8607AF33BA000BB595DB4F98094FDEA23D06B3E392
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

16894

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\DistributedAutoLink\Temp\CompileOutputDir\RsStub.pdb

kernel32

GetLastError OpenEventA CreateThread InterlockedExchange GetACP GetLocaleInfoA GetThreadLocale SizeofResource LockResource LoadResource FindResourceA FindResourceExA WideCharToMultiByte CreateProcessA GetPrivateProfileSectionA GetModuleFileNameA GetCommandLineA MultiByteToWideChar RaiseException WaitForSingleObject DeleteCriticalSection SetStdHandle SetFilePointer GetStringTypeW GetStringTypeA IsBadCodePtr lstrcpyA lstrlenA LoadLibraryA GetProcAddress GetVersionExA FreeLibrary GetWindowsDirectoryA lstrcatA GetTickCount Sleep GetCurrentProcess CloseHandle InitializeCriticalSection HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap EnterCriticalSection LeaveCriticalSection ExitProcess RtlUnwind VirtualProtect VirtualAlloc GetSystemInfo VirtualQuery GetModuleHandleA GetStartupInfoA QueryPerformanceCounter GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime GetOEMCP GetCPInfo LCMapStringA LCMapStringW SetUnhandledExceptionFilter HeapCreate VirtualFree IsBadWritePtr TerminateProcess WriteFile GetStdHandle UnhandledExceptionFilter FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType IsBadReadPtr FlushFileBuffers

advapi32

CloseServiceHandle CreateServiceA ChangeServiceConfigA RegOpenKeyExA RegQueryValueExA RegCloseKey OpenSCManagerA OpenServiceA QueryServiceStatus StartServiceA OpenProcessToken GetTokenInformation

Sharing