jaffacakes118_Trojan-Ransom[.]Win32[.]Zerber[.]ejgi[.]ba5c25351216e2f8d24fc19f97e91be1

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan-Ransom.Win32.Zerber.ejgi.ba5c25351216e2f8d24fc19f97e91be1
Size 499KB
Sample261016-e2r2mag16y
SHA256 1ce3d05a944b51bc86dc790a5ec460603aefa5cf6fb15be79607cd70d3cfa8d9
MD5 ba5c25351216e2f8d24fc19f97e91be1
SHA1 0a35383d6e710e9da6cad5a95a413717889c05d4
SHA512 ea2ce3f19ea54683612b760a329f9597f12b47a9df41e7c7f717d4a7e37f213d0b4c69ce77715febac767f4e500b11981f1f3caad238c4bc25d68b055206e571
SSDEEP 6144:y4pX7VB1eDLW/2Jy3kWs5BNNAbiQIaNAoxNaCVFMUx+G9uWaV0:/BADqk9vfyNXQKhpgWaC
TLSH
T12AB48C4F96D4CE63D8638ABBC4E9842606138F5C5A4CBC55F2BD7CF638A22727390749
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

revoked_codesign

Malware Config

Signatures

Revoked Certificate in Chain 1 IoCs

One or more certificates in the signing chain have been revoked, indicating potential compromise.

revoked_codesign

resource
jaffacakes118_Trojan-Ransom.Win32.Zerber.ejgi.ba5c25351216e2f8d24fc19f97e91be1

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
jaffacakes118_Trojan-Ransom.Win32.Zerber.ejgi.ba5c25351216e2f8d24fc19f97e91be1

File Explorer

jaffacakes118_Trojan-Ransom.Win32.Zerber.ejgi.ba5c25351216e2f8d24fc19f97e91be1

.exe 499KB

jaffacakes118_Trojan-Ransom.Win32.Zerber.ejgi.ba5c25351216e2f8d24fc19f97e91be1

IMPHASH 11fdd3d1e47896b6c7d6df76daf2a8dc
SHA256 1ce3d05a944b51bc86dc790a5ec460603aefa5cf6fb15be79607cd70d3cfa8d9
MD5 ba5c25351216e2f8d24fc19f97e91be1
SHA1 0a35383d6e710e9da6cad5a95a413717889c05d4
SHA512 ea2ce3f19ea54683612b760a329f9597f12b47a9df41e7c7f717d4a7e37f213d0b4c69ce77715febac767f4e500b11981f1f3caad238c4bc25d68b055206e571
SSDEEP 6144:y4pX7VB1eDLW/2Jy3kWs5BNNAbiQIaNAoxNaCVFMUx+G9uWaV0:/BADqk9vfyNXQKhpgWaC
TLSH
T12AB48C4F96D4CE63D8638ABBC4E9842606138F5C5A4CBC55F2BD7CF638A22727390749
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Revoked Certificate in Chain

One or more certificates in the signing chain have been revoked, indicating potential compromise.

revoked_codesign
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

7c:30:78:cc:a6:26:9b:bd:c6:df:72:9c:b4:74:ff:d0:dc:5d:28:c6

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=DEMUS\, OOO,OU=IT,O=DEMUS\, OOO,POSTALCODE=410010,STREET=d. 84 of. 2\, ul.Tankistov,L=Saratov,ST=RU,C=RU,2.5.4.18=#1306343130303130

Chains

Jul 18, 2017

CN=DEMUS\, OOO,OU=IT,O=DEMUS\, OOO,POSTALCODE=410010,STREET=d. 84 of. 2\, ul.Tankistov,L=Saratov,ST=RU,C=RU,2.5.4.18=#1306343130303130

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Minor OS version

Major OS version

Entry point

414560

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

FileTimeToDosDateTime ExitProcess EnumUILanguagesA EnumSystemLanguageGroupsA EnumDateFormatsA EnterCriticalSection DuplicateHandle DeleteFileW DeleteCriticalSection FileTimeToSystemTime CreateRemoteThread CreateProcessW CreatePipe CreateMutexW CreateFileW CreateFileA CreateEventW CreateDirectoryW CreateDirectoryExA FindAtomW FindResourceW FlushFileBuffers FormatMessageW FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCalendarInfoA GetCommandLineW GetComputerNameW GetConsoleAliasExesLengthA GetConsoleAliasesW GetConsoleCP GetConsoleFontSize GetConsoleMode GetConsoleOutputCP GetConsoleScreenBufferInfo GetCurrentConsoleFont BackupRead GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDateFormatA GetDateFormatW GetEnvironmentStringsW GetEnvironmentVariableW VirtualAllocEx lstrlenW lstrlenA lstrcpynW lstrcpyW lstrcmpiA lstrcmpW lstrcatW _llseek WriteFileGather WriteFile WriteConsoleW WriteConsoleA WideCharToMultiByte WaitForSingleObject WaitForMultipleObjects VirtualFree VirtualAlloc VerLanguageNameW UpdateResourceA UnmapViewOfFile UnhandledExceptionFilter TlsSetValue TlsGetValue TlsFree TlsAlloc TerminateThread TerminateProcess SystemTimeToFileTime Sleep SizeofResource SetUnhandledExceptionFilter SetThreadPriority SetStdHandle SetPriorityClass SetNamedPipeHandleState SetLastError SetHandleCount SetFilePointer SetFileAttributesA SetEvent SetErrorMode SetEnvironmentVariableA SetCurrentDirectoryW SetConsoleCursorPosition RtlUnwind ResumeThread RemoveDirectoryA ReadFile RaiseException QueueUserAPC QueryPerformanceFrequency QueryPerformanceCounter PeekNamedPipe OutputDebugStringW OpenSemaphoreW MultiByteToWideChar MulDiv MoveFileA LockResource LocalLock LoadResource LoadLibraryA LeaveCriticalSection LCMapStringW LCMapStringA IsValidLocale IsValidCodePage IsDebuggerPresent IsBadStringPtrA IsBadReadPtr IsBadHugeWritePtr InterlockedIncrement InterlockedDecrement InitializeCriticalSectionAndSpinCount HeapSize HeapReAlloc HeapFree HeapCreate HeapAlloc GlobalSize GlobalFree GlobalAlloc GetWriteWatch GetVolumeNameForVolumeMountPointA GetUserDefaultLCID GetTimeZoneInformation GetTimeFormatW GetTimeFormatA GetTickCount GetTempFileNameW GetSystemTimeAsFileTime GetStringTypeW GetStringTypeA GetStdHandle GetStartupInfoW GetStartupInfoA GetProcessHeap GetProcAddress GetPrivateProfileStringW GetPrivateProfileIntW GetOEMCP GetModuleHandleW GetModuleHandleA GetModuleFileNameW GetModuleFileNameA GetLongPathNameA GetLocaleInfoA GetLocalTime GetLastError GetFullPathNameA GetFileType GetFileSize GetFileInformationByHandle GetExitCodeThread CreateThread CreateDirectoryA CopyFileW CompareStringW CompareStringA CloseHandle GetExitCodeProcess

user32

WindowFromDC IsCharAlphaW DrawMenuBar OpenIcon GetDlgCtrlID GetMessageTime IsWindowUnicode IsCharUpperA GetSysColor CreatePopupMenu GetClipboardViewer GetKeyState GetActiveWindow EnumClipboardFormats GetSysColorBrush IsCharAlphaA GetTopWindow CountClipboardFormats CloseDesktop DestroyMenu OemKeyScan CloseWindow GetDC CallMsgFilterA EnumDisplayMonitors EnumPropsExA GrayStringA HideCaret IMPSetIMEA IsHungAppWindow MessageBoxA SetClassLongW SetDeskWallpaper LoadIconW IsCharAlphaNumericW IsClipboardFormatAvailable GetMenuItemCount GetAsyncKeyState GetInputState GetWindowDC IsGUIThread GetListBoxInfo DestroyCursor GetMessagePos GetLastActivePopup

gdi32

CreatePen AddFontResourceW GetEnhMetaFileA GetPolyFillMode CloseFigure GetStretchBltMode PathToRegion GetDCPenColor CreateHalftonePalette GetColorSpace FlattenPath GetTextCharset GetTextColor SetMetaRgn CloseMetaFile SwapBuffers UpdateColors TranslateCharsetInfo TextOutW StretchDIBits StretchBlt StartPage StartDocW SetWindowOrgEx SetWindowExtEx SetViewportOrgEx SetViewportExtEx SetTextJustification SetTextColor SetStretchBltMode SetROP2 SetPolyFillMode SetPixel SetMapperFlags SetMapMode SetLayoutWidth SetBrushOrgEx SetBoundsRect SetBkMode SetBkColor SetBitmapDimensionEx SetAbortProc SelectPalette SelectObject SelectClipRgn SelectClipPath ScaleViewportExtEx STROBJ_bEnumPositionsOnly RoundRect ResizePalette Rectangle RectInRegion RealizePalette PtInRegion PolylineTo Polyline Polygon PolyPolygon PolyBezier PlayEnhMetaFile Pie PATHOBJ_vEnumStartClipLines OffsetWindowOrgEx OffsetRgn MoveToEx MirrorRgn MaskBlt LineTo GetTextMetricsW GetTextFaceW GetTextExtentPoint32W GetTextExtentExPointW GetSystemPaletteEntries GetStockObject GetRgnBox GetRegionData GetRandomRgn GetPixel GetPaletteEntries GetOutlineTextMetricsW GetObjectW GetObjectType GetNearestPaletteIndex GetLogColorSpaceW GetFontLanguageInfo GetEnhMetaFileW GetEnhMetaFileHeader GetDeviceCaps GetDIBits GetDIBColorTable GetClipBox GetCharWidthW GetCharABCWidthsW GetBkColor GetBitmapDimensionEx GdiSetPixelFormat GdiGetDC GdiFlush GdiEntry6 FontIsLinked FONTOBJ_pvTrueTypeFontFile ExtTextOutW ExtSelectClipRgn ExtFloodFill ExtEscape ExtCreateRegion ExtCreatePen ExcludeClipRect EudcUnloadLinkW EqualRgn EnumFontFamiliesW EnumFontFamiliesExW EngStrokeAndFillPath EngLockSurface EngEraseSurface EndPage EndDoc Ellipse DeleteObject DeleteEnhMetaFile DeleteDC CreateSolidBrush CreateRectRgnIndirect CreateRectRgn CreatePatternBrush CreatePalette CreateICW CreateHatchBrush CreateFontIndirectW CreateEnhMetaFileW CreateEnhMetaFileA CreateDIBitmap CreateDIBSection CreateDCW CreateCompatibleDC CreateCompatibleBitmap CreateBitmap CombineRgn CloseEnhMetaFile CLIPOBJ_bEnum BitBlt Arc AnimatePalette

comdlg32

ChooseFontW CommDlgExtendedError GetOpenFileNameW GetSaveFileNameW PageSetupDlgW PrintDlgW

advapi32

RegOpenKeyExW SetSecurityDescriptorOwner SetSecurityDescriptorGroup SetSecurityDescriptorDacl RegSetValueExW RegQueryValueExW RegEnumValueW AccessCheck AddAccessAllowedAce AllocateAndInitializeSid DuplicateToken FreeSid GetLengthSid GetUserNameW InitializeAcl InitializeSecurityDescriptor IsValidSecurityDescriptor OpenProcessToken OpenThreadToken RegCloseKey RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegEnumKeyW

shell32

ExtractIconEx CommandLineToArgvW DoEnvironmentSubstA DoEnvironmentSubstW DragAcceptFiles DragFinish DragQueryFileW DragQueryPoint ExtractAssociatedIconExW ExtractIconExW ExtractIconW FindExecutableW SHAddToRecentDocs SHBindToParent SHBrowseForFolderW SHCreateDirectoryExW SHEmptyRecycleBinA SHGetDiskFreeSpaceA SHGetFileInfo SHGetFileInfoW SHGetFolderPathW SHGetIconOverlayIndexA SHGetInstanceExplorer SHGetMalloc SHGetPathFromIDListW SHGetSettings Shell_NotifyIcon ShellExecuteW ShellExecuteExW ShellAboutW SHLoadInProc SHInvokePrinterCommandW SHGetSpecialFolderLocation

ole32

ReleaseStgMedium RegisterDragDrop OleUninitialize OleSetContainedObject OleSetClipboard OleRun OleLockRunning RevokeDragDrop OleInitialize OleGetClipboard OleFlushClipboard CreateStreamOnHGlobal CoTaskMemFree CoTaskMemAlloc CoLockObjectExternal CoCreateInstance OleIsCurrentClipboard

shlwapi

StrCmpNA StrRStrIW

comctl32

ImageList_Replace ImageList_ReplaceIcon ImageList_SetBkColor ImageList_SetDragCursorImage InitializeFlatSB ImageList_DragLeave ImageList_Remove ImageList_Add ImageList_BeginDrag ImageList_Create ImageList_Destroy ImageList_DragEnter ImageList_GetImageInfo ImageList_DragMove ImageList_Draw ImageList_EndDrag ImageList_GetIconSize ImageList_GetImageCount

msvcrt

memset