jaffacakes118_not-a-virus[.]HEUR[.]AdWare[.]Win32[.]Gamevance[.]gen[.]dbf6bf2d2bd16c1bdde89fdcbdd2746f

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Gamevance.gen.dbf6bf2d2bd16c1bdde89fdcbdd2746f
Size 1.0MB
Sample261015-2r96saev4r
SHA256 a9023a11d02742aa1302a8f3eec5e57239c8838ba37350547fed133916efbfcc
MD5 dbf6bf2d2bd16c1bdde89fdcbdd2746f
SHA1 6a49df52cca27e7a7b131abc9d30e3b70450bb78
SHA512 dc04deea79892ba2379abdf0205f73cbf7424398e0f9a3692de4b179cbfbe47ab0ff1d0ad9c8edfffa1c168bd64667ca9bb3e8be541b2a59a836b16e4aa9672b
SSDEEP 24576:WqYHvxbgTRQPjUa4aNaBw2B8sOx2AFBsEs7CtkpAjtMPGPz8:WqY6TRkjUa4aNaBw8rxGXs7QkpAI+8
TLSH
T1D035022677A0C473D8A200345DF1E7B6A77BEDB05D525A83B69C3F9EBF302815D29206
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Gamevance.gen.dbf6bf2d2bd16c1bdde89fdcbdd2746f

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Gamevance.gen.dbf6bf2d2bd16c1bdde89fdcbdd2746f

.exe 1.0MB

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Gamevance.gen.dbf6bf2d2bd16c1bdde89fdcbdd2746f

IMPHASH ed1f101b454c201c4c8d2dd9e1ef40c0
SHA256 a9023a11d02742aa1302a8f3eec5e57239c8838ba37350547fed133916efbfcc
MD5 dbf6bf2d2bd16c1bdde89fdcbdd2746f
SHA1 6a49df52cca27e7a7b131abc9d30e3b70450bb78
SHA512 dc04deea79892ba2379abdf0205f73cbf7424398e0f9a3692de4b179cbfbe47ab0ff1d0ad9c8edfffa1c168bd64667ca9bb3e8be541b2a59a836b16e4aa9672b
SSDEEP 24576:WqYHvxbgTRQPjUa4aNaBw2B8sOx2AFBsEs7CtkpAjtMPGPz8:WqY6TRkjUa4aNaBw8rxGXs7QkpAI+8
TLSH
T1D035022677A0C473D8A200345DF1E7B6A77BEDB05D525A83B69C3F9EBF302815D29206
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

9c:51:c0:c1:1f:c4:1c:a2:59:05:ef:76:26:e3:bc:12

Digest Algorithm

md5

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=EpicPlay LLC,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=IT,O=EpicPlay LLC,L=Irvine,ST=California,C=US

Chains

Jan 1, 0001

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

Serial Number

18:da:d1:9e:26:7d:e8:bb:4a:21:58:cd:cc:6b:3b:4a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 8, 2006 - Jul 16, 2036

Subject

CN=EpicPlay LLC,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=IT,O=EpicPlay LLC,L=Irvine,ST=California,C=US

Serial Number

55:2a:c8:e7:22:40:6e:6c:2d:bb:f5:a9:f8:30:00:e9

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 15, 2011 - Aug 14, 2012

Minor OS version

Major OS version

Entry point

155215

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

shlwapi

StrStrA StrChrA StrToIntA SHDeleteKeyA PathFileExistsA wnsprintfA StrStrIA StrNCatA

version

VerQueryValueA GetFileVersionInfoSizeA

psapi

GetModuleFileNameExA

kernel32

GetVersionExA lstrcpynA MoveFileExA lstrcatA SetCurrentDirectoryA WaitForMultipleObjects GetModuleHandleA GetCurrentDirectoryA GetTempPathA WaitForSingleObject FindResourceA lstrcmpA LoadResource InterlockedIncrement InterlockedDecrement GetCurrentProcess GlobalLock InitializeCriticalSection GlobalAlloc SizeofResource LeaveCriticalSection MulDiv IsDBCSLeadByte MultiByteToWideChar GlobalUnlock FlushInstructionCache RaiseException SetLastError EnterCriticalSection DeleteCriticalSection GetCurrentThreadId MapViewOfFile ExpandEnvironmentStringsA CreateFileMappingA OpenFileMappingA OpenMutexA GetFileAttributesA GetComputerNameA GetVolumeInformationA LocalFree GetTickCount FreeResource GlobalFree LockResource GetFullPathNameA DosDateTimeToFileTime SetFileTime GetFileTime LoadLibraryA GetSystemTimeAsFileTime GetLocaleInfoA RtlUnwind FlushFileBuffers GetLocalTime QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetEndOfFile SetStdHandle InitializeCriticalSectionAndSpinCount SetHandleCount GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA GetStdHandle HeapCreate HeapSize TlsFree TlsSetValue TlsAlloc TlsGetValue IsValidCodePage GetOEMCP GetACP GetCPInfo GetStartupInfoA GetCommandLineA GetConsoleMode GetConsoleCP GetFileType HeapReAlloc IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter VirtualQuery GetSystemInfo GetModuleHandleW VirtualProtect VirtualAlloc CreateThread VirtualFree IsProcessorFeaturePresent InterlockedCompareExchange lstrcpyA DeleteFileA LoadLibraryExA GetProcAddress FreeLibrary ReadFile HeapFree SetFilePointer GetFileSize CreateToolhelp32Snapshot CreateMutexA GetModuleFileNameA Process32Next GetLastError TerminateProcess CreateProcessA GetExitCodeProcess Sleep OpenProcess WriteFile GetProcessHeap SleepEx Process32First HeapAlloc ExitProcess CloseHandle WritePrivateProfileStringA GetPrivateProfileStringA CreateDirectoryA lstrlenA CreateFileA lstrcmpiA lstrlenW WideCharToMultiByte LocalFileTimeToFileTime GetCurrentProcessId

user32

GetDlgItem ShowWindow GetWindowThreadProcessId MessageBoxA EnumWindows SendMessageA LoadCursorA FindWindowA SystemParametersInfoA DispatchMessageA SetWindowPos DefWindowProcA PeekMessageA CreateWindowExA GetWindowLongA TranslateMessage IsDialogMessageA ExitWindowsEx SetCursor GetWindowDC DrawFocusRect ClientToScreen GetClassNameA DestroyAcceleratorTable ScreenToClient IsChild GetClassInfoExA SetCapture DrawTextA RegisterWindowMessageA CreateAcceleratorTableA UnregisterClassA GetDesktopWindow GetSysColor GetSysColorBrush IsWindow ReleaseCapture CallWindowProcA GetWindow InvalidateRgn RedrawWindow GetWindowTextLengthA IsDlgButtonChecked CheckRadioButton EnableWindow FillRect CharNextA SetWindowTextA GetDlgCtrlID MoveWindow EndPaint GetKeyState GetFocus GetParent IsWindowEnabled BeginPaint GetDC GetWindowTextA SetWindowLongA InvalidateRect ReleaseDC PostMessageA UpdateWindow DestroyWindow GetMessageA GetWindowRect RegisterClassExA PostQuitMessage LoadIconA GetClientRect SetFocus

gdi32

SetTextColor CreateFontA SetBkMode DeleteObject SelectObject CreateCompatibleDC GetTextExtentPointA GetObjectA GetStockObject TextOutA BitBlt CreateSolidBrush SetBkColor CreateRectRgn CreateCompatibleBitmap GetDeviceCaps GetMapMode SetMapMode DPtoLP LPtoDP DeleteDC CreateDIBitmap

advapi32

QueryServiceStatus CloseServiceHandle OpenServiceA RegQueryInfoKeyA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken LookupAccountNameA RegCreateKeyExA RegEnumKeyExA RegDeleteValueA ConvertSidToStringSidA RegEnumKeyA OpenSCManagerA RegOpenKeyExA RegOpenKeyA RegCloseKey RegCreateKeyA RegDeleteKeyA RegQueryValueExA RegSetValueExA

shell32

ShellExecuteExA SHGetFolderPathA

ole32

CLSIDFromProgID CoTaskMemRealloc CoGetClassObject CoTaskMemFree OleUninitialize OleInitialize StringFromGUID2 CreateStreamOnHGlobal OleLockRunning CoTaskMemAlloc CoCreateInstance CLSIDFromString

oleaut32

VariantInit SysAllocStringLen OleCreateFontIndirect VarUI4FromStr LoadRegTypeLi OleLoadPicture VariantClear SysStringLen SysAllocString LoadTypeLi SysFreeString

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.Gamevance.gen.dbf6bf2d2bd16c1bdde89fdcbdd2746f

PE Signature issue

shlwapi

version

psapi

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

generic