jaffacakes118_not-a-virus[.]AdWare[.]Win32[.]StartSurf[.]bqkk[.]be186165b20dbcc2d66df20bed87c77e

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_not-a-virus.AdWare.Win32.StartSurf.bqkk.be186165b20dbcc2d66df20bed87c77e
Size 2.2MB
Sample261015-2nb5kstsfv
SHA256 a41297c427103fec66638cbd9c2326f1adfb915b69b7b188487fec58eb4a0a44
MD5 be186165b20dbcc2d66df20bed87c77e
SHA1 c06c5dc07c20a8641503454dc96fea71eb4cfc1e
SHA512 ce8e90cb8344baa45f5285a697c6869fadab91b0a5958284d4d66378b58581aba2c07c8d2bb0521ffd622b459e25b8aa89b0b8806cb519d4820cce47379f7480
SSDEEP 24576:H3aCLu4r4r/fX4RBtLI5OSEmjaGThy/7+UrKzB0vrJK9Uyln:HHrru4Rc5MO2+UIIq
TLSH
T145B52324AB8240B7D4E2423219A5E8F916597D518A691CC727C43F3FBA73080DF75EB7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_not-a-virus.AdWare.Win32.StartSurf.bqkk.be186165b20dbcc2d66df20bed87c77e

File Explorer

jaffacakes118_not-a-virus.AdWare.Win32.StartSurf.bqkk.be186165b20dbcc2d66df20bed87c77e

.exe 2.2MB

jaffacakes118_not-a-virus.AdWare.Win32.StartSurf.bqkk.be186165b20dbcc2d66df20bed87c77e

IMPHASH 7a7a97ecbf7489836ad84fa7f0dc2572
SHA256 a41297c427103fec66638cbd9c2326f1adfb915b69b7b188487fec58eb4a0a44
MD5 be186165b20dbcc2d66df20bed87c77e
SHA1 c06c5dc07c20a8641503454dc96fea71eb4cfc1e
SHA512 ce8e90cb8344baa45f5285a697c6869fadab91b0a5958284d4d66378b58581aba2c07c8d2bb0521ffd622b459e25b8aa89b0b8806cb519d4820cce47379f7480
SSDEEP 24576:H3aCLu4r4r/fX4RBtLI5OSEmjaGThy/7+UrKzB0vrJK9Uyln:HHrru4Rc5MO2+UIIq
TLSH
T145B52324AB8240B7D4E2423219A5E8F916597D518A691CC727C43F3FBA73080DF75EB7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

621326

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

UnregisterTraceGuids RegQueryValueExW

setupapi

SetupDiOpenDeviceInfoW SetupOpenInfFileW CM_Get_Parent SetupDiOpenDeviceInterfaceW SetupDiGetDeviceInstanceIdW SetupDiGetClassDevsW SetupDiCallClassInstaller SetupGetStringFieldW SetupGetIntField SetupGetLineCountW SetupCloseInfFile SetupDiSetDeviceInstallParamsW SetupDiGetActualSectionToInstallW SetupDiGetDeviceInstallParamsW

kernel32

CloseHandle WriteConsoleW SetFilePointerEx SetStdHandle GetConsoleMode GetConsoleCP FlushFileBuffers LCMapStringW HeapReAlloc HeapAlloc ExitProcess SetFilePointer DeleteCriticalSection CreateProcessW HeapSize GetLastError GetCPInfo GetModuleHandleW GetEnvironmentStringsW WaitForSingleObject MultiByteToWideChar GetACP GetFileAttributesW InterlockedIncrement FindFirstFileW GetCommandLineW CompareStringW GetTempPathW GetStringTypeW LoadLibraryW GlobalLock InterlockedExchange CreateDirectoryW FreeResource GlobalAlloc VirtualAlloc VirtualFree FindResourceW EnumResourceNamesW GetPrivateProfileStructW CreateTimerQueue GetUserDefaultUILanguage OutputDebugStringW RtlUnwind LoadLibraryExW HeapFree LeaveCriticalSection EnterCriticalSection GetOEMCP RaiseException EncodePointer SetLastError GetCurrentThreadId DecodePointer GetModuleHandleExW GetProcAddress WideCharToMultiByte GetProcessHeap GetStdHandle GetFileType GetStartupInfoW GetModuleFileNameW WriteFile QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount Sleep GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree IsProcessorFeaturePresent IsDebuggerPresent IsValidCodePage CreateFileW

shell32

SHPathPrepareForWriteW SHGetDesktopFolder SHGetPathFromIDListW

user32

IsChild OemKeyScan CreateMenu GetListBoxInfo DdeImpersonateClient