jaffacakes118_Trojan[.]MSIL[.]Crypt[.]gopi[.]55c1239522fb91af8392120bd9686406

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan.MSIL.Crypt.gopi.55c1239522fb91af8392120bd9686406
Size 575KB
Sample261016-d2aa5swwd1
SHA256 933aef05823a8552ee1c6a3d90b732c20ca728575cc12be32729600b0d56fbb9
MD5 55c1239522fb91af8392120bd9686406
SHA1 cf7c63a1a9e7a6aa0803270a9dc5394fd37a4532
SHA512 08580912eecb67a461e5f161a7012186ccdc5b4205ab78ef49434338cafb3c4e7e1f87ad0693945c7f4e706f95261f469a7314462300fda3fcbd8aa265355e50
SSDEEP 12288:zNWJhlTQMhwrLRYMMnkPQpOy7KxH6we4dfP1p2kw14:BWJDTQswrOMVTmoN7bg4
TLSH
T17AC4E1AA6AB48D21D0956A73F0638220A272EC7477C417936313FF3D66F7385C256E87
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan.MSIL.Crypt.gopi.55c1239522fb91af8392120bd9686406

File Explorer

jaffacakes118_Trojan.MSIL.Crypt.gopi.55c1239522fb91af8392120bd9686406

.exe 575KB

jaffacakes118_Trojan.MSIL.Crypt.gopi.55c1239522fb91af8392120bd9686406

IMPHASH a1836697d2c4395fc32b5d2b1b80c96c
SHA256 933aef05823a8552ee1c6a3d90b732c20ca728575cc12be32729600b0d56fbb9
MD5 55c1239522fb91af8392120bd9686406
SHA1 cf7c63a1a9e7a6aa0803270a9dc5394fd37a4532
SHA512 08580912eecb67a461e5f161a7012186ccdc5b4205ab78ef49434338cafb3c4e7e1f87ad0693945c7f4e706f95261f469a7314462300fda3fcbd8aa265355e50
SSDEEP 12288:zNWJhlTQMhwrLRYMMnkPQpOy7KxH6we4dfP1p2kw14:BWJDTQswrOMVTmoN7bg4
TLSH
T17AC4E1AA6AB48D21D0956A73F0638220A272EC7477C417936313FF3D66F7385C256E87
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

56812

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\angels\rand\Release\touch.pdb

kernel32

UnhandledExceptionFilter IsDebuggerPresent TerminateProcess QueryPerformanceCounter DecodePointer SetUnhandledExceptionFilter IsProcessorFeaturePresent EncodePointer GetStartupInfoW HeapSetInformation InterlockedCompareExchange Sleep SetLastError LocalAlloc LocalFree CreateToolhelp32Snapshot CloseHandle Process32NextW GetLastError EnumSystemCodePagesW GetConsoleTitleA GetCurrentProcessId GetTickCount SetConsoleTitleA GetConsoleWindow GetEnvironmentStringsW CreateEventA WaitForSingleObject CreateDirectoryA lstrlenA GetCurrentThread GetCurrentProcess LoadLibraryA GetProcAddress GetCurrentThreadId HeapCreate DeviceIoControl lstrcpyA HeapAlloc OpenEventA GetModuleFileNameA GetSystemTimeAsFileTime InterlockedExchange

user32

DrawTextA SendMessageA LoadBitmapA MessageBoxA IsDlgButtonChecked KillTimer ShowWindow UpdateWindow wsprintfA FindWindowA SetWindowPos GetCursorPos GetScrollRange SetWindowTextA GetWindowTextLengthA GetWindowTextA CallNextHookEx GetActiveWindow GetWindowThreadProcessId GetKeyboardLayout GetKeyboardState MapVirtualKeyExA ToUnicodeEx GetWindowRect ScreenToClient SetRect GetClientRect FillRect GetSysColorBrush GetDlgItem GetWindowLongA SetWindowLongA InvalidateRect CreateWindowExA DestroyWindow DefWindowProcA OffsetRect GetSystemMetrics DrawFrameControl GetDC ReleaseDC PostQuitMessage BeginPaint EndPaint MoveWindow SetPropA GetPropA CallWindowProcA SetDlgItemTextA GetDlgItemTextA EndDialog CheckRadioButton CheckDlgButton

gdi32

SetAbortProc SetStretchBltMode TextOutA SelectObject ExcludeClipRect CreateSolidBrush EndPage StartPage StartDocA GetPixel SetBkMode SetTextCharacterExtra CreateFontIndirectA SelectClipRgn SetWindowOrgEx CreateCompatibleDC SetTextColor EndDoc SetWindowExtEx GetStockObject CreateCompatibleBitmap BitBlt DeleteObject DeleteDC GetObjectA SetBkColor GetTextMetricsA

comdlg32

GetOpenFileNameA PrintDlgA

advapi32

SetEntriesInAclA InitializeSecurityDescriptor SetSecurityDescriptorDacl RegCreateKeyExA FreeSid RegCloseKey OpenThreadToken OpenProcessToken PrivilegeCheck AllocateAndInitializeSid

ole32

CoLockObjectExternal RevokeDragDrop CreateStreamOnHGlobal CoInitialize CoCreateInstance CoRegisterClassObject

oleaut32

SafeArrayCreate SafeArrayLock SafeArrayPtrOfIndex SysAllocString SafeArrayUnlock UnRegisterTypeLi VarBoolFromI2 VarBoolFromI4 VarBoolFromR4 LoadTypeLibEx SafeArrayAccessData SafeArrayUnaccessData SafeArrayCreateVector VariantInit

wininet

InternetCloseHandle InternetWriteFile FtpOpenFileA InternetOpenA InternetGetLastResponseInfoA InternetConnectA

ws2_32

WSAAsyncGetHostByAddr

msvcp100

?_BADOFF@std@@3_JB ?_Incref@facet@locale@std@@QAEXXZ ?_Decref@facet@locale@std@@QAEPAV123@XZ ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAPAD0PAH001@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ ?always_noconv@codecvt_base@std@@QBE_NXZ ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?_Xlength_error@std@@YAXPBD@Z ?_Xout_of_range@std@@YAXPBD@Z ?_Lockit_dtor@_Lockit@std@@SAXH@Z ?_Getcat@?$codecvt@DDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ??Bid@locale@std@@QAEIXZ ?_Lockit_ctor@_Lockit@std@@SAXH@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ ?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z ?in@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ?unshift@?$codecvt@DDH@std@@QBEHAAHPAD1AAPAD@Z ?out@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ ?id@?$codecvt@DDH@std@@2V0locale@2@A

version

GetFileVersionInfoSizeA

shlwapi

PathAppendA

comctl32

ord412 ImageList_Destroy ImageList_AddMasked ImageList_Create ord413

uxtheme

CloseThemeData DrawThemeBackground OpenThemeData

msvcr100

__FrameUnwindFilter fsetpos _fseeki64 fgetpos fputc setvbuf __CxxUnregisterExceptionObject __CxxDetectRethrow __CxxQueryExceptionSize __CxxRegisterExceptionObject fgetc memcpy_s ??1exception@std@@UAE@XZ ??0exception@std@@QAE@ABQBD@Z memmove _mbsstr _CxxThrowException ??0bad_cast@std@@QAE@PBD@Z ??2@YAPAXI@Z ??_V@YAXPAX@Z _lock_file _unlock_file fflush ?what@exception@std@@UBEPBDXZ ??1bad_cast@std@@UAE@XZ ??0bad_cast@std@@QAE@ABV01@@Z ??0exception@std@@QAE@ABV01@@Z rand atoi sprintf fclose fwrite _wfopen_s free malloc __CxxFrameHandler3 _CIsqrt _CIlog _CIasin _CIsin floor memset ??3@YAXPAX@Z _amsg_exit __getmainargs _cexit _exit _XcptFilter _ismbblead exit _acmdln _initterm _initterm_e _configthreadlocale __setusermatherr _commode _fmode __set_app_type ?terminate@@YAXXZ ?_type_info_dtor_internal_method@type_info@@QAEXXZ _unlock __dllonexit _lock _onexit _except_handler4_common _invoke_watson _controlfp_s _crt_debugger_hook __CxxExceptionFilter ungetc

mscoree

_CorExeMain