jaffacakes118_not-a-virus[.]AdWare[.]Win32[.]Wajam[.]dy[.]b0ef058a3a8ae10993655acb6da62d70

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_not-a-virus.AdWare.Win32.Wajam.dy.b0ef058a3a8ae10993655acb6da62d70
Size 1.2MB
Sample261015-2pt2saev2p
SHA256 1c7db6e16bb6f9e713f70991868caa09a4dbdae8822a8f6369e6d1b05f5fabbf
MD5 b0ef058a3a8ae10993655acb6da62d70
SHA1 1ceed826089d16870f69b5f4481b03c53d329f63
SHA512 a2132bbd13a64f3b3291383d416e137b84bcdd39f81c8421e7b1e318d840b3976824aea5990498523bf11a1dc6b76769f925af10c7e9558edd3d070db7d649f7
SSDEEP 24576:o8HTMsWLGlAmO2qwJfS/DPO1JCwGkZsdTndP7mwZi:oQMsWLuA12qWuqKkZsdTdDbZi
TLSH
T107454A20B712C57ACA9E02F06D7C9E1E602D6AA54B6448C3E7DCAEDE2C754C35333A57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_not-a-virus.AdWare.Win32.Wajam.dy.b0ef058a3a8ae10993655acb6da62d70

File Explorer

jaffacakes118_not-a-virus.AdWare.Win32.Wajam.dy.b0ef058a3a8ae10993655acb6da62d70

.dll 1.2MB

jaffacakes118_not-a-virus.AdWare.Win32.Wajam.dy.b0ef058a3a8ae10993655acb6da62d70

IMPHASH 4e1126d58352b2dcf2992a936bd0ba64
SHA256 1c7db6e16bb6f9e713f70991868caa09a4dbdae8822a8f6369e6d1b05f5fabbf
MD5 b0ef058a3a8ae10993655acb6da62d70
SHA1 1ceed826089d16870f69b5f4481b03c53d329f63
SHA512 a2132bbd13a64f3b3291383d416e137b84bcdd39f81c8421e7b1e318d840b3976824aea5990498523bf11a1dc6b76769f925af10c7e9558edd3d070db7d649f7
SSDEEP 24576:o8HTMsWLGlAmO2qwJfS/DPO1JCwGkZsdTndP7mwZi:oQMsWLuA12qWuqKkZsdTdDbZi
TLSH
T107454A20B712C57ACA9E02F06D7C9E1E602D6AA54B6448C3E7DCAEDE2C754C35333A57
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

701720

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

wajam_goblin.pdb

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

ws2_32

ntohs htons getsockopt connect freeaddrinfo getaddrinfo WSAGetLastError setsockopt WSASocketW WSASend WSARecv select ioctlsocket closesocket WSACleanup WSAStartup WSASetLastError ntohl htonl

kernel32

SetEnvironmentVariableA SetEndOfFile GetTimeZoneInformation InitializeSListHead LoadLibraryW Sleep FreeLibraryAndExitThread GetProcAddress GetCurrentThreadId CreateThread GetModuleHandleExW OpenProcess GetCurrentProcessId GetModuleFileNameW GetNativeSystemInfo IsWow64Process QueryInformationJobObject GetLastError CloseHandle GetCurrentProcess GetModuleHandleW SetThreadPriority CreateFileW ReadFile GetExitCodeThread WaitForSingleObject TerminateThread OpenEventW SetEvent ResetEvent FreeLibrary GetSystemTimeAsFileTime CreateEventA InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection TlsAlloc InterlockedIncrement InterlockedExchange InterlockedDecrement InterlockedExchangeAdd InitializeCriticalSectionAndSpinCount WaitForMultipleObjects QueueUserAPC SleepEx PostQueuedCompletionStatus CreateIoCompletionPort SetWaitableTimer GetQueuedCompletionStatus InterlockedCompareExchange SetLastError TlsGetValue TlsSetValue TlsFree HeapReAlloc HeapAlloc HeapFree RaiseException DecodePointer FileTimeToSystemTime GetModuleHandleA GetThreadTimes OutputDebugStringW WriteConsoleW SetStdHandle FlushFileBuffers FormatMessageA OpenEventA CreateEventW FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetModuleFileNameA GetStdHandle GetOEMCP GetACP IsValidCodePage WideCharToMultiByte MultiByteToWideChar GetStringTypeW EncodePointer IsProcessorFeaturePresent GetCommandLineA GetCPInfo ExitThread LoadLibraryExW IsDebuggerPresent ExitProcess AreFileApisANSI FileTimeToLocalFileTime GetFileInformationByHandle GetFileType PeekNamedPipe GetConsoleMode ReadConsoleW SetFilePointerEx WriteFile GetConsoleCP RtlUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess GetStartupInfoW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapSize GetProcessHeap GetCurrentThread

user32

BringWindowToTop EnumWindows GetClassNameW GetWindowTextW SendMessageTimeoutW SetActiveWindow

advapi32

RegCloseKey RegOpenKeyExW