jaffacakes118_Trojan[.]Win32[.]Agent[.]qwhagm[.]ce018e86529afc0cc7a4ceede15a294f

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan.Win32.Agent.qwhagm.ce018e86529afc0cc7a4ceede15a294f
Size 193KB
Sample261015-3bqb4sys5l
SHA256 7e4cd05a4d1c05fca356edee5c02059f3fda282f4e39ffc399860e5e1f549dfb
MD5 ce018e86529afc0cc7a4ceede15a294f
SHA1 3aba71fc85e796257d835a88fe525f70dc8d4ca1
SHA512 c0383cfd9983e42d1dcba91ab19d583192bf63fbd8439e66509e0e6057820a27dc1098b9cb879ada6e7c3965da20f516d8b5894969cdf25c7efbe31ab4062e55
SSDEEP 6144:Ib7zYttwENm2eK7mnoUSgpAY8ODcDcm7cIsnK24xHCVYrRwrztasTLAO3+w:IbOuV4xdATLN+
TLSH
T18B148D2174D2C473D1B305305DE4C7B5AABDB9320B6A8EAB77A41B2D4E740E2C631EB5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan.Win32.Agent.qwhagm.ce018e86529afc0cc7a4ceede15a294f

File Explorer

jaffacakes118_Trojan.Win32.Agent.qwhagm.ce018e86529afc0cc7a4ceede15a294f

.exe 193KB

jaffacakes118_Trojan.Win32.Agent.qwhagm.ce018e86529afc0cc7a4ceede15a294f

IMPHASH eb17abeb74320d5ae18d850c0775053b
SHA256 7e4cd05a4d1c05fca356edee5c02059f3fda282f4e39ffc399860e5e1f549dfb
MD5 ce018e86529afc0cc7a4ceede15a294f
SHA1 3aba71fc85e796257d835a88fe525f70dc8d4ca1
SHA512 c0383cfd9983e42d1dcba91ab19d583192bf63fbd8439e66509e0e6057820a27dc1098b9cb879ada6e7c3965da20f516d8b5894969cdf25c7efbe31ab4062e55
SSDEEP 6144:Ib7zYttwENm2eK7mnoUSgpAY8ODcDcm7cIsnK24xHCVYrRwrztasTLAO3+w:IbOuV4xdATLN+
TLSH
T18B148D2174D2C473D1B305305DE4C7B5AABDB9320B6A8EAB77A41B2D4E740E2C631EB5
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

46757

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CloseHandle WideCharToMultiByte GetModuleFileNameA Process32First TerminateProcess CreateMutexA OpenProcess CreateToolhelp32Snapshot GetSystemWow64DirectoryW Sleep CopyFileA GetLastError GlobalAlloc Process32Next SetFileAttributesA GlobalLock CreateFileA GlobalUnlock IsDebuggerPresent CreateFileW SetFilePointerEx GetConsoleMode GetConsoleCP FlushFileBuffers HeapSize SetStdHandle SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage MultiByteToWideChar WriteFile CreateDirectoryA FindNextFileA FindFirstFileExA FindClose GetFileType GetProcessHeap EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetACP EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer GetCPInfo CompareStringW LCMapStringW GetLocaleInfoW SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress GetStringTypeW IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead GetCurrentProcess RtlUnwind RaiseException FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW HeapAlloc HeapFree HeapReAlloc GetStdHandle WriteConsoleW

user32

SetClipboardData SendMessageA GetClipboardData CharToOemA FindWindowA MessageBoxA GetWindowTextA EmptyClipboard CloseClipboard OpenClipboard MessageBeep IsClipboardFormatAvailable GetForegroundWindow EnumDisplayDevicesA

advapi32

RegQueryValueExA RegOpenKeyExA RegCloseKey

shell32

ShellExecuteA

ole32

CoCreateInstance CoUninitialize

wininet

InternetSetFilePointer InternetReadFile InternetConnectA HttpQueryInfoA HttpOpenRequestA InternetOpenUrlA InternetSetOptionA InternetCloseHandle HttpAddRequestHeadersA InternetOpenA HttpSendRequestA