jaffacakes118_not-a-virus[.]AdWare[.]Win32[.]Wajam[.]ev[.]e42da69c2031705a00f428dfcfdde6f0

General

Target
jaffacakes118_not-a-virus.AdWare.Win32.Wajam.ev.e42da69c2031705a00f428dfcfdde6f0
Size 1.2MB
Sample261015-2qch5aev3k
SHA256 3b25d631392af0d89e7b0a6c4135932a7332e0b7742d55aaf2243d08cad6fce7
MD5 e42da69c2031705a00f428dfcfdde6f0
SHA1 5d832ee5fadac655573e99d4a15c2a68350db830
SHA512 8f4f199801e646c832ac063003f809f66366657c05953d623d0ee14aacb3eef14754d36d181e23a2a9260df6a6a9544a0b8d0dbca4667048b8d0dfe692573729
SSDEEP 24576:61BgbD31YlWHXtpd3yZf8VkxcBzJSH2THYxguhM3T:6sbD316Wdpd3yKu80H2T4x9M3T
TLSH
T197454A20B701C17ADA9E02F16D7CAE5E606D6EA54BA448C3F3C8AE9D2C754C35333A57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_not-a-virus.AdWare.Win32.Wajam.ev.e42da69c2031705a00f428dfcfdde6f0

File Explorer

jaffacakes118_not-a-virus.AdWare.Win32.Wajam.ev.e42da69c2031705a00f428dfcfdde6f0

.dll 1.2MB

jaffacakes118_not-a-virus.AdWare.Win32.Wajam.ev.e42da69c2031705a00f428dfcfdde6f0

IMPHASH bd0d34a9ffe0fb16c089440e6827e72d
SHA256 3b25d631392af0d89e7b0a6c4135932a7332e0b7742d55aaf2243d08cad6fce7
MD5 e42da69c2031705a00f428dfcfdde6f0
SHA1 5d832ee5fadac655573e99d4a15c2a68350db830
SHA512 8f4f199801e646c832ac063003f809f66366657c05953d623d0ee14aacb3eef14754d36d181e23a2a9260df6a6a9544a0b8d0dbca4667048b8d0dfe692573729
SSDEEP 24576:61BgbD31YlWHXtpd3yZf8VkxcBzJSH2THYxguhM3T:6sbD316Wdpd3yKu80H2T4x9M3T
TLSH
T197454A20B701C17ADA9E02F16D7CAE5E606D6EA54BA448C3F3C8AE9D2C754C35333A57
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

702856

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

wajam_goblin.pdb

kernel32

IsWow64Process QueryInformationJobObject GetLastError CloseHandle GetCurrentProcess GetModuleHandleW SetThreadPriority CreateFileW ReadFile GetExitCodeThread WaitForSingleObject TerminateThread OpenEventW CreateEventW SetEvent ResetEvent FreeLibrary GetSystemTimeAsFileTime CreateEventA GetNativeSystemInfo InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection TlsAlloc InterlockedIncrement InterlockedExchange InterlockedDecrement InterlockedExchangeAdd InitializeCriticalSectionAndSpinCount WaitForMultipleObjects QueueUserAPC SleepEx PostQueuedCompletionStatus CreateIoCompletionPort SetWaitableTimer GetQueuedCompletionStatus InterlockedCompareExchange SetLastError TlsGetValue TlsSetValue TlsFree HeapReAlloc HeapAlloc HeapFree RaiseException DecodePointer FileTimeToSystemTime GetModuleFileNameW GetCurrentProcessId OpenProcess GetModuleHandleExW CreateThread GetCurrentThreadId GetProcAddress FreeLibraryAndExitThread Sleep LoadLibraryW EncodePointer OpenEventA FormatMessageA WideCharToMultiByte MultiByteToWideChar GetStringTypeW LoadLibraryExA IsProcessorFeaturePresent GetCommandLineA GetCPInfo ExitThread LoadLibraryExW IsDebuggerPresent ExitProcess AreFileApisANSI FileTimeToLocalFileTime GetFileInformationByHandle GetFileType PeekNamedPipe GetConsoleMode ReadConsoleW SetFilePointerEx WriteFile GetConsoleCP RtlUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess GetStartupInfoW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapSize GetProcessHeap GetCurrentThread IsValidCodePage GetACP GetOEMCP GetStdHandle GetModuleFileNameA QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW FlushFileBuffers SetStdHandle WriteConsoleW OutputDebugStringW GetThreadTimes GetModuleHandleA InitializeSListHead GetTimeZoneInformation SetEndOfFile SetEnvironmentVariableA

advapi32

RegCloseKey RegOpenKeyExW

Sharing