jaffacakes118_Trojan-Ransom[.]Win32[.]Shade[.]ndg[.]f6402c5dccd957c6231e4902df7c2865

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan-Ransom.Win32.Shade.ndg.f6402c5dccd957c6231e4902df7c2865
Size 1.0MB
Sample261016-eykhdaff37
SHA256 a6471b8ea3b85c148a224157126c0ea3db8e803af5f93daa7deb4d63afc38d90
MD5 f6402c5dccd957c6231e4902df7c2865
SHA1 8dd6205623e695bb4ab7f02ca5d31249becde7d9
SHA512 9b90926308552c8cad4f5545a994910651eca44e8296869bcf1d9f746b010447f124be4d3b6e395241f6e5895cb2d1ab885e6246a59acd96dbcf3508a1b24b8b
SSDEEP 24576:0KIzS+8vc0BMTrwIH9+32OThwo57G3FnCrFC7fiOwZvB:P+8vc58jdwQwFCBrOwZp
TLSH
T1CE3512027A97E5A2CC6543304590B6E50FBCEC377B701CAFA7D83E5F56B02D48A7A261
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan-Ransom.Win32.Shade.ndg.f6402c5dccd957c6231e4902df7c2865

File Explorer

jaffacakes118_Trojan-Ransom.Win32.Shade.ndg.f6402c5dccd957c6231e4902df7c2865

.exe 1.0MB

jaffacakes118_Trojan-Ransom.Win32.Shade.ndg.f6402c5dccd957c6231e4902df7c2865

IMPHASH 20762095dd639467a5f1d330fadd467d
SHA256 a6471b8ea3b85c148a224157126c0ea3db8e803af5f93daa7deb4d63afc38d90
MD5 f6402c5dccd957c6231e4902df7c2865
SHA1 8dd6205623e695bb4ab7f02ca5d31249becde7d9
SHA512 9b90926308552c8cad4f5545a994910651eca44e8296869bcf1d9f746b010447f124be4d3b6e395241f6e5895cb2d1ab885e6246a59acd96dbcf3508a1b24b8b
SSDEEP 24576:0KIzS+8vc0BMTrwIH9+32OThwo57G3FnCrFC7fiOwZvB:P+8vc58jdwQwFCBrOwZp
TLSH
T1CE3512027A97E5A2CC6543304590B6E50FBCEC377B701CAFA7D83E5F56B02D48A7A261
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

18452

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Ted\Coding\flying\refined\tidyR.pdb

kernel32

GetLocaleInfoA MultiByteToWideChar HeapSize GetOEMCP GetCPInfo Sleep InitializeCriticalSection GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter GetStringTypeA GetStringTypeW LCMapStringA LCMapStringW lstrcpyA LocalFree GetModuleHandleA LoadLibraryA GetLocalTime GetProcAddress GetLastError lstrlenW WideCharToMultiByte SystemTimeToFileTime FormatMessageA HeapAlloc GetACP lstrlenA GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA InterlockedDecrement GetCurrentThreadId SetLastError InterlockedIncrement TlsFree TlsSetValue TlsAlloc TlsGetValue GetModuleFileNameA GetStdHandle WriteFile ExitProcess HeapReAlloc VirtualAlloc EnterCriticalSection LeaveCriticalSection DeleteCriticalSection VirtualFree HeapCreate HeapDestroy RtlUnwind HeapFree TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCommandLineA GetVersionExA GetProcessHeap GetStartupInfoA RaiseException

user32

CreateWindowExA GetWindowLongA ReleaseDC TranslateMessage GetDC ShowCaret SendMessageA GetCursorPos DispatchMessageA MessageBoxW GetSystemMetrics SetCaretPos LoadCursorA DialogBoxParamA SetScrollInfo TrackPopupMenuEx GetMessageA HideCaret GetWindowRect InsertMenuItemA MonitorFromPoint SendDlgItemMessageA FillRect SetCapture LoadIconA IsWindowEnabled

gdi32

GetROP2 DeleteDC CreateDIBSection DeleteObject SelectObject CreateCompatibleDC DPtoLP SetMapMode CreateCompatibleBitmap GetMapMode GetPolyFillMode GetBkColor GetPixel GetObjectA GetStockObject CreateSolidBrush TextOutA BitBlt

advapi32

AccessCheck ImpersonateLoggedOnUser

shell32

SHGetFolderPathW SHBrowseForFolderA

oleaut32

OleSavePictureFile

odbc32

ord235 ord234 ord236

msi

ord281 ord278

winscard

SCardGetStatusChangeA

pdh

PdhCloseQuery PdhAddCounterW PdhCollectQueryData PdhOpenQueryA

gdiplus

GdipFree GdipCloneImage GdipDisposeImage GdipAlloc GdipLoadImageFromFile

tapi32

phoneGetDevCapsW phoneGetDisplay