jaffacakes118_Trojan[.]Win32[.]Agent[.]qwhdui[.]83e79e5572dc46a07d258ad8662fab1d

General

Target
jaffacakes118_Trojan.Win32.Agent.qwhdui.83e79e5572dc46a07d258ad8662fab1d
Size 3.6MB
Sample261015-3cddyaex2q
SHA256 d09814ac8bb8e341f866ad08634275b5ac15b0d46177be5785e89b8cb88327e8
MD5 83e79e5572dc46a07d258ad8662fab1d
SHA1 4a2cc9b8379822f86cdd521126ea9bce58142f49
SHA512 b7f7f1e595d5630197fa8f524de0a20804f6fcc245a93ce940ee70306ea3a88179ce7d6d2d911458ac6a7f62024c8fff4c67da7fb703be7386ff3b38bd1eeebe
SSDEEP 49152:yZoG4Fidu0egS+eouWYqoAWeT8RT+aBcYYz41YEq9jNqno4Z1sHHRh7gIu6iufsi:yZoGd3lN1ceE3D6RFIufn070L7fzROR0
TLSH
T1CA06E031BAD3803BD17A0932096DEB9E91B97E215FB1889B73A42F7D0A314924531F77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan.Win32.Agent.qwhdui.83e79e5572dc46a07d258ad8662fab1d

File Explorer

jaffacakes118_Trojan.Win32.Agent.qwhdui.83e79e5572dc46a07d258ad8662fab1d

.exe 3.6MB

jaffacakes118_Trojan.Win32.Agent.qwhdui.83e79e5572dc46a07d258ad8662fab1d

IMPHASH 816d22f6caf18286fc75bb4ac9ea9b94
SHA256 d09814ac8bb8e341f866ad08634275b5ac15b0d46177be5785e89b8cb88327e8
MD5 83e79e5572dc46a07d258ad8662fab1d
SHA1 4a2cc9b8379822f86cdd521126ea9bce58142f49
SHA512 b7f7f1e595d5630197fa8f524de0a20804f6fcc245a93ce940ee70306ea3a88179ce7d6d2d911458ac6a7f62024c8fff4c67da7fb703be7386ff3b38bd1eeebe
SSDEEP 49152:yZoG4Fidu0egS+eouWYqoAWeT8RT+aBcYYz41YEq9jNqno4Z1sHHRh7gIu6iufsi:yZoGd3lN1ceE3D6RFIufn070L7fzROR0
TLSH
T1CA06E031BAD3803BD17A0932096DEB9E91B97E215FB1889B73A42F7D0A314924531F77
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

898777

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\JobRelease\win\Release\stubs\x86\ExternalUi.pdb

kernel32

CreateFileW CloseHandle WriteFile DeleteFileW GetLastError SizeofResource LockResource LoadResource FindResourceW FindResourceExW HeapDestroy HeapSize HeapReAlloc HeapFree HeapAlloc GetProcessHeap InterlockedDecrement InterlockedIncrement EnterCriticalSection LeaveCriticalSection GetModuleFileNameW DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetCurrentThreadId RaiseException SetLastError GlobalUnlock GlobalLock GlobalAlloc MulDiv lstrcmpW CreateEventW SetEvent InitializeCriticalSection lstrcpynW WaitForSingleObject CreateThread GetProcAddress LoadLibraryExW DecodePointer Sleep GetDiskFreeSpaceExW GetExitCodeThread GetCurrentProcessId CreateDirectoryW GetSystemDirectoryW FreeLibrary lstrlenW GetVersionExW lstrcmpiW GetModuleHandleW LoadLibraryW GetDriveTypeW CompareStringW GetTempPathW GetSystemTime SystemTimeToFileTime GetTempFileNameW FindFirstFileW RemoveDirectoryW FindNextFileW GetLogicalDriveStringsW GetFileSize GetFileAttributesW SetFileAttributesW GetFileTime CopyFileW ReadFile FindClose MultiByteToWideChar WideCharToMultiByte InterlockedExchange GetCurrentProcess GetSystemInfo WaitForMultipleObjects WriteConsoleW VirtualProtect VirtualQuery LoadLibraryExA GetShortPathNameW GetStringTypeW SetUnhandledExceptionFilter FormatMessageW GetEnvironmentVariableW LocalFree LoadLibraryA GetModuleFileNameA GetFullPathNameW GetCurrentThread SetFilePointer FlushFileBuffers SetConsoleTextAttribute GetStdHandle GetConsoleScreenBufferInfo OutputDebugStringW CreateProcessW GetExitCodeProcess GetCommandLineW SetCurrentDirectoryW SetEndOfFile EnumResourceLanguagesW GetLocaleInfoW GetSystemDefaultLangID GetUserDefaultLangID GetWindowsDirectoryW FileTimeToSystemTime CreateToolhelp32Snapshot Process32FirstW Process32NextW ResetEvent MoveFileW GlobalFree GetPrivateProfileStringW GetPrivateProfileSectionNamesW WritePrivateProfileStringW GetLocalTime CreateNamedPipeW ConnectNamedPipe TerminateThread LocalAlloc CompareFileTime CopyFileExW OpenEventW PeekNamedPipe IsDebuggerPresent EncodePointer InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetCPInfo LCMapStringW WaitForSingleObjectEx UnhandledExceptionFilter TerminateProcess GetStartupInfoW QueryPerformanceCounter RtlUnwind QueryPerformanceFrequency GetACP ExitProcess GetModuleHandleExW GetFileType IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleCP GetConsoleMode IsValidCodePage GetOEMCP SetFilePointerEx FindFirstFileExW GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle ReadConsoleW

Sharing