187da9c62f2bb374dd967824d901310ff274673e1ff7c1de0e8c0d6ab658b90c

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.InstaFast.gen.123b3493fbf27a83b9c3197848a4c4a8
Size 1.5MB
Sample261015-2sr2lattaz
SHA256 187da9c62f2bb374dd967824d901310ff274673e1ff7c1de0e8c0d6ab658b90c
MD5 123b3493fbf27a83b9c3197848a4c4a8
SHA1 02962e52cc52be0caa98f790ebd92939908143fd
SHA512 d8bfd8381fd474634889af5a234e6deea6139d9da6f5f48a5011f1b103de4a85d79c88e185e5deb9591278bb3da2e25ddcaefe531283df7159269c1f858d25ef
SSDEEP 49152:vM9og1Pv3TDNtKrVv4YJCIMiVOuPDxW6uo7xwN0:k9ogh3TaJCvGR3tL
TLSH
T140752300278998A3DCE3D73231B5DB2746E07D45F1B1AD5E2629F00A2E33691FD1DB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  jaffacakes118_not-a-virus.HEUR.AdWare.Win32.InstaFast.gen.123b3493fbf27a83b9c3197848a4c4a8
- Size 1.5MB
- SHA256 187da9c62f2bb374dd967824d901310ff274673e1ff7c1de0e8c0d6ab658b90c
- MD5 123b3493fbf27a83b9c3197848a4c4a8
- SHA1 02962e52cc52be0caa98f790ebd92939908143fd
- SHA512 d8bfd8381fd474634889af5a234e6deea6139d9da6f5f48a5011f1b103de4a85d79c88e185e5deb9591278bb3da2e25ddcaefe531283df7159269c1f858d25ef
- SSDEEP 49152:vM9og1Pv3TDNtKrVv4YJCIMiVOuPDxW6uo7xwN0:k9ogh3TaJCvGR3tL
- TLSH
  T140752300278998A3DCE3D73231B5DB2746E07D45F1B1AD5E2629F00A2E33691FD1DB6A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

adware discovery persistence spyware
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 2e226715419a5882e2e14278940ee8ef0aa648a3ef7af5b3dc252674111962bc
- MD5 a4dd044bcd94e9b3370ccf095b31f896
- SHA1 17c78201323ab2095bc53184aa8267c9187d5173
- SHA512 87335a43b9ca13e1300c7c23e702e87c669e2bcf4f6065f0c684fc53165e9c1f091cc4d79a3eca3910f0518d3b647120ac0be1a68eaade2e75eaa64adfc92c5a
- SSDEEP 192:em24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35OlESl:m8QIl975eXqlWBrz7YLOlE
- TLSH
  T168325C12135081F3E4918138886B3A276B6A15029BF98E57DFD39646BE21BE3BD7D603
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/npHelper.dll
- Size 276KB
- SHA256 7576aba6b1401abcdf821ef63d447d855b584e66fc6a3e87984b0a3ea47a7c1a
- MD5 f8ca603bb06b017d25373e46d419fc61
- SHA1 5bed6ab329b26b3be62c3973ffec9d7cc0b8b6a7
- SHA512 2a662082bad2f7aab06f9d5d32d5bddab4fd14aed4576a3231b2b7bf7831744786ace3ded8d21ddf10ab5aeee1a0681ac5067cd8a702b808ef01d7a98a471ff4
- SSDEEP 6144:IYQ1Kr6cOyE8YxY/fecRAOuO+/aPv4Y9dsUXPkG1p0:IYPF3E8Y4XkdMr1q
- TLSH
  T1E7549E117582C432D4BE053018789B6A46BDBD300FA4C9EFA7D41E7D4F762C1AA36A7B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 067c77d51df034b4a614f83803140fbf4cd2f8684b88ea8c8acdf163edad085a
- MD5 0d45588070cf728359055f776af16ec4
- SHA1 c4375ceb2883dee74632e81addbfa4e8b0c6d84a
- SHA512 751ebf4c43f100b41f799d0fbf8db118ea8751df029c1f4c4b0daeb0fef200ddf2e41c1c9c55c2dc94f2c841cf6acb7df355e98a2e5877a7797f0f1d41a7e415
- SSDEEP 192:ob8cSzvTyl4tgi8pPjQM0PuAg0YNyhIFtSP:mBSzm+t18pZ0WAg0RhIFg
- TLSH
  T1E412F793E5A820B3C2D3533F35BE2B2EC7B95335B0512C0482739A497A6947A6E38347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/terms.rtf
- Size 25KB
- SHA256 e574e50039d95463fbaa0ffdc10c6278ebb6cdbf58a0c27db11efd06fb2e3bdf
- MD5 1153e2a560d57a437f1d36c83f71f4d4
- SHA1 c3c7bcf70b78d9f73f07bc0669e369f93a29b48c
- SHA512 3592f5e0b170dc90b1f86d7b65ede4ae3feacb4234deb47a4cfc9893c2c2212b6cb0d5cfd37c46389d027acea11bec84cce8f90a980c303e2338c74bc406097c
- SSDEEP 768:tqWJISmWT4vzCulk6IZ0zrl3gxDaZE7SsvA:tJIYT74dSaa7Sso
- TLSH
  T197B2DA6F730213B10D9D0331664A69D6E72A92BCBAB697D0A451901D2373E34C3B7ADB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  $_14_/$_14_/$_19_.exe
- Size 2.7MB
- SHA256 8a8e1b74d404f5cd680253eee7342220a8e18f0e71e8a1a5aa3473a47556302f
- MD5 123714923607754257a7f052ccc0311a
- SHA1 b6dd7a6c6b289ac0b97dac2f390a64b8e4f014e5
- SHA512 ba66cc870ef3ae8c8ba422ac4641b0a6b0f938e84c36ab33ac4bb318dbb27663b690c0c9f9df615f249b578eb534ee365c963e09d4641858892a07cc8cf7e13b
- SSDEEP 49152:OlWwlvEEI4B+r+XU7lgkUyfc1qaXCwL7v+ABH0/uWdMyWjevlODyYX4KqC0FYT:O5aE9k7lgSc19tL7dHrDR
- TLSH
  T1F0D5BF213A81D437C13201725D3EE26B657E7D129B6408D7B2DC7AAE1FBCAC16632F16
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  $_14_/Uninstall.exe
- Size 102KB
- SHA256 051223282bce767dd6f57b38104c1c389725d2a2379e09a6239b8e02012362e3
- MD5 6a2213dd11936d128af2d3f96a43a596
- SHA1 8c7191d97d67311455d4a42cf4bcaabc48c668f0
- SHA512 563ac4da1d8acca5ad78d50c75b9226a8af00d25f1d6229d3b122a8c5f4b4469d90d59ac424e1d427c81b99bcadb4b60f5971051011638e5c78907df255f4000
- SSDEEP 3072:d4lLpkXGED3iNuJZndILLBR1I7Ac+38hZK:mpkXGha7u3nEZK
- TLSH
  T1EFA3BD017310C457DAB7473528B5EB7AAEF66E10F9A09E0B07507E0DBEB2282BD19716
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral13 behavioral14