jaffacakes118_Worm[.]Win32[.]AutoRun[.]fcyi[.]87ccd68bce399f4cd914d542dbe6ef3a

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Worm.Win32.AutoRun.fcyi.87ccd68bce399f4cd914d542dbe6ef3a
Size 106KB
Sample261015-2ehwrstsbs
SHA256 5c293cc2a85f811a072123233b81bd7926145b2cabd9e06f5ec63418b6511899
MD5 87ccd68bce399f4cd914d542dbe6ef3a
SHA1 119f9d78350982dcc1a0a4c22fcf5cf799e1bd36
SHA512 115493b2802e0e47c040c5c5829cf0bf2549338b1889820cb5a4932618f49909638b3aa70dd56eee704e72bd9ca81e1b35bd8ae87c1a7a5ebc20c2c3e18f1bac
SSDEEP 1536:F+FDoKtniY1u7Nn2JFkC2styJjCKICFjC7EWisS+5mlatSfkZ:F+FDzK71QkbstyJjCKICpC72s/mlaX
TLSH
T144B3E166F79A08D2D2848F3B878AAD70CE457D13464B10B989843FBF9D37D01B56C27A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Worm.Win32.AutoRun.fcyi.87ccd68bce399f4cd914d542dbe6ef3a

File Explorer

jaffacakes118_Worm.Win32.AutoRun.fcyi.87ccd68bce399f4cd914d542dbe6ef3a

.exe 106KB

jaffacakes118_Worm.Win32.AutoRun.fcyi.87ccd68bce399f4cd914d542dbe6ef3a

IMPHASH ddbb90ebf41500dde8a2155d2d44be6d
SHA256 5c293cc2a85f811a072123233b81bd7926145b2cabd9e06f5ec63418b6511899
MD5 87ccd68bce399f4cd914d542dbe6ef3a
SHA1 119f9d78350982dcc1a0a4c22fcf5cf799e1bd36
SHA512 115493b2802e0e47c040c5c5829cf0bf2549338b1889820cb5a4932618f49909638b3aa70dd56eee704e72bd9ca81e1b35bd8ae87c1a7a5ebc20c2c3e18f1bac
SSDEEP 1536:F+FDoKtniY1u7Nn2JFkC2styJjCKICFjC7EWisS+5mlatSfkZ:F+FDzK71QkbstyJjCKICpC72s/mlaX
TLSH
T144B3E166F79A08D2D2848F3B878AAD70CE457D13464B10B989843FBF9D37D01B56C27A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4540

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

oleaut32

VariantChangeTypeEx SysStringLen SysAllocStringLen VariantCopyInd VariantClear

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

advapi32

RegQueryValueExA RegCloseKey OpenProcessToken RegOpenKeyExA LookupPrivilegeValueA

kernel32

SetCommConfig CreateFileA CloseHandle FindResourceA Sleep DeleteFileA VirtualFree SetFilePointer SetErrorMode GetSystemInfo RemoveDirectoryA ReadFile GetUserDefaultLangID OutputDebugStringA GetEnvironmentVariableA GetWindowsDirectoryA GetLocaleInfoA LoadLibraryA GetACP LockResource GetFileSize FormatMessageA FlushViewOfFile GetExitCodeProcess GetFullPathNameA GetLastError GetSystemDefaultLCID SetEndOfFile GetFileAttributesA LoadResource VirtualQuery GetCurrentProcess SizeofResource GetProcAddress GetVersionExA GetModuleHandleA GetCommandLineA GetModuleFileNameA IsDBCSLeadByte CreateProcessA VirtualProtect CreateDirectoryA VirtualAlloc InterlockedExchange WriteFile ReadFile GetCommandLineA GetModuleHandleA GetLastError GetStdHandle CreateFileA GetFileSize ExitProcess WideCharToMultiByte LocalAlloc TlsSetValue VirtualAlloc LocalFree WriteFile LeaveCriticalSection GetFileType SetEndOfFile TlsGetValue SetFilePointer CloseHandle VirtualFree MultiByteToWideChar GetSystemTime RaiseException EnterCriticalSection DeleteCriticalSection

user32

MessageBoxA SetWindowLongA CharPrevA ExitWindowsEx TranslateMessage MsgWaitForMultipleObjects LoadStringA CallWindowProcA DestroyWindow CreateWindowExA PeekMessageA DispatchMessageA