jaffacakes118_Trojan[.]Win32[.]Agent[.]qwjctl[.]85ecdc8c30649159102d04bf549cf1a9

General

Target
jaffacakes118_Trojan.Win32.Agent.qwjctl.85ecdc8c30649159102d04bf549cf1a9
Size 848KB
Sample261015-3kam1sys8p
SHA256 5611ebe7c1fa758a26c82a9932707548bfdd8c6cbaebba77c500ba79f356c478
MD5 85ecdc8c30649159102d04bf549cf1a9
SHA1 604ec56baba8c18cf9bc4467127fc7d25295e8c4
SHA512 451f592c66f7aed84860ca746b73161510629add104388e66405137bfcbe7c9489bda6ad28988a92ce940a43c09a85b6566c15b91f1b85c73463f6e806415523
SSDEEP 24576:0cgCYQ1LGum4sx8Kofd/uV+w3q77Mk7fGJUB:LgCh1LGumhuW+0q7LzGiB
TLSH
T135052300B9A5AAB2E829483100AB8746973FFCA9D9A483177FC9F96FDC703505F53D16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

jaffacakes118_Trojan.Win32.Agent.qwjctl.85ecdc8c30649159102d04bf549cf1a9

.exe 848KB

jaffacakes118_Trojan.Win32.Agent.qwjctl.85ecdc8c30649159102d04bf549cf1a9

IMPHASH d2c82993d1a616abe994cabd5db7b4f8
SHA256 5611ebe7c1fa758a26c82a9932707548bfdd8c6cbaebba77c500ba79f356c478
MD5 85ecdc8c30649159102d04bf549cf1a9
SHA1 604ec56baba8c18cf9bc4467127fc7d25295e8c4
SHA512 451f592c66f7aed84860ca746b73161510629add104388e66405137bfcbe7c9489bda6ad28988a92ce940a43c09a85b6566c15b91f1b85c73463f6e806415523
SSDEEP 24576:0cgCYQ1LGum4sx8Kofd/uV+w3q77Mk7fGJUB:LgCh1LGumhuW+0q7LzGiB
TLSH
T135052300B9A5AAB2E829483100AB8746973FFCA9D9A483177FC9F96FDC703505F53D16
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

30:bd:04:ce:f9:1c:62:18:95:3e:f9:80:67:59:d5:9e:77:85:f1:87:24:18:49:9c:26:90:1e:4d:7f:cb:98:13

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=MicroNames Corp,OU=IT Team,O=MicroNames Corp,L=Guro-gu,ST=SEOUL,C=KR

Chains

Apr 17, 2019

CN=MicroNames Corp,OU=IT Team,O=MicroNames Corp,L=Guro-gu,ST=SEOUL,C=KR

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Serial Number

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=MicroNames Corp,OU=IT Team,O=MicroNames Corp,L=Guro-gu,ST=SEOUL,C=KR

Serial Number

39:b2:a6:49:48:b0:2d:c7:bd:5d:6d:f1:63:56:d0:a2

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 8, 2018 - Oct 8, 2019

Minor OS version

0

Major OS version

4

Entry point

12409

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetUnhandledExceptionFilter lstrcmpiA lstrcpyA lstrlenA _lclose GetModuleFileNameA _lread _llseek _lopen _lwrite _lcreat CreateDirectoryA SetCurrentDirectoryA lstrcatA FreeLibrary GetProcAddress LoadLibraryA GetDiskFreeSpaceA UnhandledExceptionFilter RemoveDirectoryA DeleteFileA GetTempPathA GetCurrentDirectoryA CloseHandle GetExitCodeProcess LocalFree Sleep HeapSize RtlUnwind LCMapStringW LCMapStringA GetStringTypeW GetCurrentProcess GetFileAttributesA TerminateProcess MultiByteToWideChar GetStringTypeA GetModuleHandleA TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId GetLastError InterlockedDecrement ExitProcess HeapFree HeapAlloc GetCommandLineA GetVersionExA GetProcessHeap GetStartupInfoA DeleteCriticalSection LeaveCriticalSection EnterCriticalSection GetCPInfo GetACP GetOEMCP IsValidCodePage WriteFile GetStdHandle InitializeCriticalSection HeapDestroy HeapCreate VirtualFree VirtualAlloc HeapReAlloc FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetLocaleInfoA

user32

TranslateMessage DispatchMessageA PeekMessageA wsprintfA LoadCursorA SetCursor MessageBoxA MsgWaitForMultipleObjects

advapi32

GetTokenInformation OpenProcessToken

shell32

ShellExecuteExA

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_Trojan.Win32.Agent.qwjctl.85ecdc8c30649159102d04bf549cf1a9

kernel32

user32

advapi32

shell32

generic