jaffacakes118_not-a-virus[.]HEUR[.]AdWare[.]Win32[.]InstaFast[.]gen[.]123b3493fbf27a83b9c3197848a4c4a8

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.InstaFast.gen.123b3493fbf27a83b9c3197848a4c4a8
Size 1.5MB
Sample261015-2sr2lattaz
SHA256 187da9c62f2bb374dd967824d901310ff274673e1ff7c1de0e8c0d6ab658b90c
MD5 123b3493fbf27a83b9c3197848a4c4a8
SHA1 02962e52cc52be0caa98f790ebd92939908143fd
SHA512 d8bfd8381fd474634889af5a234e6deea6139d9da6f5f48a5011f1b103de4a85d79c88e185e5deb9591278bb3da2e25ddcaefe531283df7159269c1f858d25ef
SSDEEP 49152:vM9og1Pv3TDNtKrVv4YJCIMiVOuPDxW6uo7xwN0:k9ogh3TaJCvGR3tL
TLSH
T140752300278998A3DCE3D73231B5DB2746E07D45F1B1AD5E2629F00A2E33691FD1DB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.InstaFast.gen.123b3493fbf27a83b9c3197848a4c4a8
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll

Untrusted Codesign Signers 3 IoCs

Codesigned file was signed by an untrusted entity.

resource
unpack001/$PLUGINSDIR/npHelper.dll
unpack001/$_14_/$_14_/$_19_.exe
unpack001/$_14_/Uninstall.exe

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.InstaFast.gen.123b3493fbf27a83b9c3197848a4c4a8

.exe 1.5MB
$PLUGINSDIR/System.dll

.dll 11KB
$PLUGINSDIR/npHelper.dll

.dll 276KB
$PLUGINSDIR/nsDialogs.dll

.dll 9KB
$PLUGINSDIR/terms.rtf

.rtf 25KB
$_14_/$_14_/$_19_.exe

.exe 2.7MB
$_14_/Uninstall.exe

.exe 102KB

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.InstaFast.gen.123b3493fbf27a83b9c3197848a4c4a8

IMPHASH 4ea4df5d94204fc550be1874e1b77ea7
SHA256 187da9c62f2bb374dd967824d901310ff274673e1ff7c1de0e8c0d6ab658b90c
MD5 123b3493fbf27a83b9c3197848a4c4a8
SHA1 02962e52cc52be0caa98f790ebd92939908143fd
SHA512 d8bfd8381fd474634889af5a234e6deea6139d9da6f5f48a5011f1b103de4a85d79c88e185e5deb9591278bb3da2e25ddcaefe531283df7159269c1f858d25ef
SSDEEP 49152:vM9og1Pv3TDNtKrVv4YJCIMiVOuPDxW6uo7xwN0:k9ogh3TaJCvGR3tL
TLSH
T140752300278998A3DCE3D73231B5DB2746E07D45F1B1AD5E2629F00A2E33691FD1DB6A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13238

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetCurrentDirectoryW GetFileAttributesW GetFullPathNameW Sleep GetTickCount CreateFileW GetFileSize MoveFileW SetFileAttributesW GetModuleFileNameW CopyFileW ExitProcess SetEnvironmentVariableW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode WaitForSingleObject GetCurrentProcess CompareFileTime GlobalUnlock GlobalLock CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA GetTempFileNameW WriteFile lstrcpyA lstrcpyW MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GlobalFree GlobalAlloc GetShortPathNameW SearchPathW lstrcmpiW SetFileTime CloseHandle ExpandEnvironmentStringsW lstrcmpW GetDiskFreeSpaceW lstrlenW lstrcpynW GetExitCodeProcess FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose MulDiv MultiByteToWideChar lstrlenA WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

GetSystemMenu SetClassLongW IsWindowEnabled EnableMenuItem SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard wsprintfW ScreenToClient GetWindowRect GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow LoadImageW SetTimer SetWindowTextW PostQuitMessage ShowWindow GetDlgItem IsWindow SetWindowLongW FindWindowExW TrackPopupMenu AppendMenuW CreatePopupMenu DrawTextW EndPaint CreateDialogParamW SendMessageTimeoutW SetForegroundWindow

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW ShellExecuteW SHFileOperationW

advapi32

RegDeleteKeyW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegOpenKeyExW RegEnumValueW RegDeleteValueW RegCloseKey RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_AddMasked ord17 ImageList_Destroy ImageList_Create

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 2e226715419a5882e2e14278940ee8ef0aa648a3ef7af5b3dc252674111962bc
MD5 a4dd044bcd94e9b3370ccf095b31f896
SHA1 17c78201323ab2095bc53184aa8267c9187d5173
SHA512 87335a43b9ca13e1300c7c23e702e87c669e2bcf4f6065f0c684fc53165e9c1f091cc4d79a3eca3910f0518d3b647120ac0be1a68eaade2e75eaa64adfc92c5a
SSDEEP 192:em24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35OlESl:m8QIl975eXqlWBrz7YLOlE
TLSH
T168325C12135081F3E4918138886B3A276B6A15029BF98E57DFD39646BE21BE3BD7D603
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10183

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/npHelper.dll

IMPHASH 003d9e8e08ac769fa06e564ed73a735a
SHA256 7576aba6b1401abcdf821ef63d447d855b584e66fc6a3e87984b0a3ea47a7c1a
MD5 f8ca603bb06b017d25373e46d419fc61
SHA1 5bed6ab329b26b3be62c3973ffec9d7cc0b8b6a7
SHA512 2a662082bad2f7aab06f9d5d32d5bddab4fd14aed4576a3231b2b7bf7831744786ace3ded8d21ddf10ab5aeee1a0681ac5067cd8a702b808ef01d7a98a471ff4
SSDEEP 6144:IYQ1Kr6cOyE8YxY/fecRAOuO+/aPv4Y9dsUXPkG1p0:IYPF3E8Y4XkdMr1q
TLSH
T1E7549E117582C432D4BE053018789B6A46BDBD300FA4C9EFA7D41E7D4F762C1AA36A7B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

db:91:eb:ca:72:15:a1:83:03:7b:d4:71:fc:c3:6e:8e:2d:e2:02:67

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Extended Cloud,O=Extended Cloud,L=Incline Village,ST=NV,C=US

Chains

Oct 15, 2026

CN=Extended Cloud,O=Extended Cloud,L=Incline Village,ST=NV,C=US

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Minor OS version

Major OS version

Entry point

75744

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetFileSize GetModuleFileNameW SizeofResource LockResource LoadResource FindResourceW FindResourceExW HeapDestroy HeapSize HeapReAlloc HeapFree HeapAlloc GetProcessHeap MultiByteToWideChar WideCharToMultiByte SetFilePointer RaiseException DecodePointer DeleteCriticalSection CreateToolhelp32Snapshot Process32FirstW GetCurrentProcessId Process32NextW OpenProcess GlobalFree lstrcpyW lstrcpynW GlobalAlloc WriteConsoleW FlushFileBuffers ReadFile GetLastError GetModuleHandleW GetProcAddress CreateFileW InitializeCriticalSectionAndSpinCount CloseHandle SetFilePointerEx GetConsoleMode GetConsoleCP WriteFile SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsDebuggerPresent OutputDebugStringW EnterCriticalSection LeaveCriticalSection SetLastError CreateEventW Sleep TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime EncodePointer LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo SetEvent ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter GetCurrentThreadId InitializeSListHead RtlUnwind FreeLibrary LoadLibraryExW InterlockedFlushSList ExitProcess GetModuleHandleExW GetModuleFileNameA GetACP GetStdHandle GetFileType IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FindClose FindFirstFileExA FindNextFileA IsValidCodePage

user32

wsprintfW

advapi32

CryptDestroyHash CryptHashData CryptReleaseContext CryptCreateHash CryptAcquireContextW CryptGetHashParam

shell32

CommandLineToArgvW

psapi

GetModuleFileNameExW

$PLUGINSDIR/nsDialogs.dll

IMPHASH e2ee55bddad4241d619d6a8a38e2d869
SHA256 067c77d51df034b4a614f83803140fbf4cd2f8684b88ea8c8acdf163edad085a
MD5 0d45588070cf728359055f776af16ec4
SHA1 c4375ceb2883dee74632e81addbfa4e8b0c6d84a
SHA512 751ebf4c43f100b41f799d0fbf8db118ea8751df029c1f4c4b0daeb0fef200ddf2e41c1c9c55c2dc94f2c841cf6acb7df355e98a2e5877a7797f0f1d41a7e415
SSDEEP 192:ob8cSzvTyl4tgi8pPjQM0PuAg0YNyhIFtSP:mBSzm+t18pZ0WAg0RhIFg
TLSH
T1E412F793E5A820B3C2D3533F35BE2B2EC7B95335B0512C0482739A497A6947A6E38347
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7443

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$_14_/$_14_/$_19_.exe

IMPHASH cc3947e5155ef4c5bb14ebaafeaa3547
SHA256 8a8e1b74d404f5cd680253eee7342220a8e18f0e71e8a1a5aa3473a47556302f
MD5 123714923607754257a7f052ccc0311a
SHA1 b6dd7a6c6b289ac0b97dac2f390a64b8e4f014e5
SHA512 ba66cc870ef3ae8c8ba422ac4641b0a6b0f938e84c36ab33ac4bb318dbb27663b690c0c9f9df615f249b578eb534ee365c963e09d4641858892a07cc8cf7e13b
SSDEEP 49152:OlWwlvEEI4B+r+XU7lgkUyfc1qaXCwL7v+ABH0/uWdMyWjevlODyYX4KqC0FYT:O5aE9k7lgSc19tL7dHrDR
TLSH
T1F0D5BF213A81D437C13201725D3EE26B657E7D129B6408D7B2DC7AAE1FBCAC16632F16
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

cb:23:db:04:0b:5b:ad:a0:09:70:7f:a9:ab:b2:fd:5a:0a:ba:1d:7b

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Extended Cloud,O=Extended Cloud,L=Incline Village,ST=NV,C=US

Chains

Oct 15, 2026

CN=Extended Cloud,O=Extended Cloud,L=Incline Village,ST=NV,C=US

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Minor OS version

Major OS version

Entry point

358196

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Autobuild\Work\trunk\SearchBar\Release\SearchBar.pdb

urlmon

CoInternetSetFeatureEnabled

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

wininet

HttpOpenRequestW InternetOpenW HttpQueryInfoW InternetCrackUrlW HttpSendRequestW InternetCloseHandle InternetConnectW InternetReadFile InternetSetOptionW

kernel32

HeapDestroy GetProcAddress GlobalLock DeleteCriticalSection GetProcessHeap GetModuleHandleW WideCharToMultiByte GetTempFileNameW GetTickCount GlobalUnlock lstrcmpW MulDiv WriteFile CreateFileW CloseHandle GetVersionExW VerSetConditionMask FreeLibrary VerifyVersionInfoW InitializeCriticalSectionAndSpinCount InitializeCriticalSection ReadFile SetNamedPipeHandleState CreateNamedPipeW DisconnectNamedPipe QueueUserWorkItem CreateEventW SetEvent WaitForSingleObjectEx WaitNamedPipeW ConnectNamedPipe FlushFileBuffers GetCommandLineW GetCurrentProcessId lstrcmpiW LoadLibraryExW K32GetModuleFileNameExW GetTempPathW LocalAlloc GetFileAttributesW OpenProcess SetFileAttributesW CreateToolhelp32Snapshot GetPrivateProfileStringW Process32NextW Process32FirstW LocalFree CopyFileW MoveFileW WriteConsoleW FindFirstFileExW FindClose EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetFileType GetACP GetStdHandle ExitProcess ExitThread VirtualQuery GetSystemInfo HeapAlloc UnregisterWaitEx QueryDepthSList InterlockedFlushSList ReleaseSemaphore VirtualProtect GetModuleHandleA FreeLibraryAndExitThread GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority CreateThread SwitchToThread SignalObjectAndWait CreateTimerQueue GetStartupInfoW TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter ResetEvent OutputDebugStringW IsDebuggerPresent LoadLibraryExA VirtualFree VirtualAlloc FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead GetLocaleInfoW LCMapStringW CompareStringW GetCPInfo GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc QueryPerformanceCounter GetCurrentThread GetCurrentProcess DuplicateHandle GetStringTypeW TryEnterCriticalSection GetModuleHandleExW IsProcessorFeaturePresent EncodePointer SetFilePointerEx GetConsoleMode GetConsoleCP SetStdHandle FindResourceW LoadResource FindResourceExW LoadLibraryW RaiseException HeapReAlloc GlobalFree DeleteFileW GlobalAlloc LockResource GetLastError Sleep MultiByteToWideChar HeapSize GetCurrentThreadId InitializeCriticalSectionEx DecodePointer LeaveCriticalSection GetModuleFileNameW EnterCriticalSection SetLastError HeapFree GlobalHandle SizeofResource FindNextFileW IsValidCodePage GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW RtlUnwind

user32

PtInRect DialogBoxParamW UpdateWindow ReleaseCapture SetForegroundWindow InvalidateRect ReleaseDC RegisterWindowMessageW CloseWindow CallNextHookEx UnhookWindowsHookEx SetWindowContextHelpId SetWindowsHookExW GetCursorPos BeginPaint EndPaint EnableWindow GetWindowTextW SetWindowTextW GetParent GetClassInfoExW CreateDialogIndirectParamW GetDesktopWindow KillTimer GetDlgItem GetClientRect MapDialogRect GetMessageW GetKeyState DispatchMessageW SetLayeredWindowAttributes TranslateMessage EndDialog SetDlgItemTextW MapWindowPoints GetUpdateRect SetCursor DrawTextW GetWindowLongW GetWindowTextLengthW DefWindowProcW CallWindowProcW PostMessageW GetWindow GetWindowRect GetFocus DestroyWindow GetDC IsWindowVisible SetWindowPos MonitorFromWindow FillRect CreateWindowExW DeleteMenu ScreenToClient SendMessageW GetSystemMetrics UnregisterClassW SetWindowLongW CreatePopupMenu SetMenuItemBitmaps RegisterClassExW TrackPopupMenu GetActiveWindow ShowWindow IsWindow InvalidateRgn SetTimer RedrawWindow GetMonitorInfoW ClientToScreen DestroyAcceleratorTable IsChild GetSysColor GetForegroundWindow IsWindowEnabled MoveWindow CreateAcceleratorTableW LoadBitmapW DestroyMenu SetFocus CharNextW BringWindowToTop LoadIconW LoadCursorW GetClassNameW SetCapture InsertMenuW

gdi32

SetTextColor SetBkMode SetViewportOrgEx SetBkColor ExtTextOutW CreateFontIndirectW BitBlt CreateCompatibleBitmap SelectObject CreateCompatibleDC GetStockObject GetDeviceCaps GetObjectW DeleteObject CreateSolidBrush DeleteDC

advapi32

RegEnumKeyExW CopySid IsValidSid OpenProcessToken ConvertSidToStringSidW GetLengthSid DuplicateTokenEx RegQueryValueExW GetTokenInformation RegCloseKey RegQueryInfoKeyW RegDeleteKeyW RegCreateKeyExW MakeSelfRelativeSD RegSetValueExW RegOpenKeyExW RegDeleteValueW GetSecurityDescriptorSacl SetSecurityDescriptorDacl GetSecurityDescriptorDacl GetSecurityDescriptorGroup GetSecurityDescriptorControl GetSecurityDescriptorOwner InitializeSecurityDescriptor GetSecurityDescriptorLength

shell32

CommandLineToArgvW SHAppBarMessage Shell_NotifyIconW ShellExecuteExW

ole32

CoTaskMemAlloc StringFromGUID2 CoCreateInstance CoGetClassObject CoTaskMemRealloc CreateStreamOnHGlobal OleInitialize CLSIDFromString OleLockRunning CoTaskMemFree CLSIDFromProgID OleUninitialize

oleaut32

LoadRegTypeLi DispCallFunc VarUI4FromStr VarBstrCat VariantInit LoadTypeLi SysFreeString OleCreateFontIndirect SysAllocString SysStringLen SysAllocStringLen VariantClear

shlwapi

PathFileExistsW PathRemoveExtensionW PathAppendW PathFindFileNameW

userenv

UnloadUserProfile

uxtheme

OpenThemeData DrawThemeText GetThemeSysColor CloseThemeData

$_14_/Uninstall.exe

IMPHASH e2a592076b17ef8bfb48b7e03965a3fc
SHA256 051223282bce767dd6f57b38104c1c389725d2a2379e09a6239b8e02012362e3
MD5 6a2213dd11936d128af2d3f96a43a596
SHA1 8c7191d97d67311455d4a42cf4bcaabc48c668f0
SHA512 563ac4da1d8acca5ad78d50c75b9226a8af00d25f1d6229d3b122a8c5f4b4469d90d59ac424e1d427c81b99bcadb4b60f5971051011638e5c78907df255f4000
SSDEEP 3072:d4lLpkXGED3iNuJZndILLBR1I7Ac+38hZK:mpkXGha7u3nEZK
TLSH
T1EFA3BD017310C457DAB7473528B5EB7AAEF66E10F9A09E0B07507E0DBEB2282BD19716
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

7a:a3:87:21:d3:cc:d3:aa:84:fc:2b:de:c4:a8:59:00:db:14:0d:7c

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Extended Cloud,O=Extended Cloud,L=Incline Village,ST=NV,C=US

Chains

Oct 15, 2026

CN=Extended Cloud,O=Extended Cloud,L=Incline Village,ST=NV,C=US

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Minor OS version

Major OS version

Entry point

12960

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetCurrentDirectoryW GetFileAttributesW GetFullPathNameW Sleep GetTickCount GetFileSize GetModuleFileNameW MoveFileW SetFileAttributesW GetCurrentProcess ExitProcess SetEnvironmentVariableW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode lstrlenW WaitForSingleObject CopyFileW CompareFileTime GlobalLock CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA CreateFileW GetTempFileNameW WriteFile lstrcpyA lstrcpyW MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GlobalFree GlobalAlloc GetShortPathNameW SearchPathW lstrcmpiW SetFileTime CloseHandle ExpandEnvironmentStringsW lstrcmpW GlobalUnlock lstrcpynW GetDiskFreeSpaceW GetExitCodeProcess FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose MulDiv MultiByteToWideChar lstrlenA WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW ShellExecuteW SHFileOperationW

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_not-a-virus.HEUR.AdWare.Win32.InstaFast.gen.123b3493fbf27a83b9c3197848a4c4a8

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/npHelper.dll

PE Signature issue

kernel32

user32

advapi32

shell32

psapi

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/terms.rtf

$_14_/$_14_/$_19_.exe

PE Signature issue

urlmon

version

wininet

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

userenv

uxtheme

generic

$_14_/Uninstall.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic