jaffacakes118_Trojan-Ransom[.]Win32[.]Shade[.]nre[.]9486d121ac4418b351f257bb3a3d09fc

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan-Ransom.Win32.Shade.nre.9486d121ac4418b351f257bb3a3d09fc
Size 1.2MB
Sample261016-eys5hs1y6n
SHA256 19723d73a6dca79ddffc7d0be2aaa3cedfda9a254fb726e5dd86628ac63ed2ce
MD5 9486d121ac4418b351f257bb3a3d09fc
SHA1 d1a275cb05eaf97bb4d7d0ad03a086bf2fd6c729
SHA512 b7572f8942e350ea215014efda783116474c6888c55c7e02c1bca193fb4d133ae2f7f4130e4fef276e867cc5429c376ce322b7de7fa5d58ef41b77face7f7e57
SSDEEP 24576:e9DXuvNicPj9gylMSKQj/WSud8EEeEG6Hl+QfmAT+q:YDevcuj9V6dQ/ud86V0Neq
TLSH
T1CA451225B4A6D471D4735A3045F099B1BB3C7C700A739EAF6398172E0F784C16B26BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan-Ransom.Win32.Shade.nre.9486d121ac4418b351f257bb3a3d09fc

File Explorer

jaffacakes118_Trojan-Ransom.Win32.Shade.nre.9486d121ac4418b351f257bb3a3d09fc

.exe 1.2MB

jaffacakes118_Trojan-Ransom.Win32.Shade.nre.9486d121ac4418b351f257bb3a3d09fc

IMPHASH c74236121a015c742c1eddf30885c297
SHA256 19723d73a6dca79ddffc7d0be2aaa3cedfda9a254fb726e5dd86628ac63ed2ce
MD5 9486d121ac4418b351f257bb3a3d09fc
SHA1 d1a275cb05eaf97bb4d7d0ad03a086bf2fd6c729
SHA512 b7572f8942e350ea215014efda783116474c6888c55c7e02c1bca193fb4d133ae2f7f4130e4fef276e867cc5429c376ce322b7de7fa5d58ef41b77face7f7e57
SSDEEP 24576:e9DXuvNicPj9gylMSKQj/WSud8EEeEG6Hl+QfmAT+q:YDevcuj9V6dQ/ud86V0Neq
TLSH
T1CA451225B4A6D471D4735A3045F099B1BB3C7C700A739EAF6398172E0F784C16B26BA7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

35840

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExA FindClose LCMapStringW SetStdHandle GetStringTypeW GetProcessHeap FlushFileBuffers GetConsoleCP GetConsoleMode ReadFile ReadConsoleW GetProcAddress HeapSize HeapReAlloc SetFilePointerEx WriteConsoleW CreateFileW EncodePointer DecodePointer MulDiv GetFileType GetConsoleWindow HeapAlloc GetCurrentDirectoryW LoadLibraryW GetSystemInfo GetEnvironmentStringsW LoadLibraryA CreateFileA GetLastError HeapFree GetACP WideCharToMultiByte MultiByteToWideChar WriteFile GetStdHandle GetModuleHandleExW ExitProcess SetLastError RtlUnwind GetModuleFileNameW LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue lstrlenA FindResourceA TlsAlloc InitializeCriticalSectionAndSpinCount RaiseException TerminateProcess GetCurrentProcess InitializeSListHead GetModuleFileNameA GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent GetModuleHandleW CreateEventW WaitForSingleObjectEx ResetEvent SetEvent DeleteCriticalSection LeaveCriticalSection EnterCriticalSection CloseHandle lstrlenW lstrcpyA FreeEnvironmentStringsW GetProcessWorkingSetSize LocalFree

user32

GetClientRect GetDlgItem EnableMenuItem GetParent AppendMenuA EndDeferWindowPos DrawMenuBar SendMessageA SendDlgItemMessageA GetAncestor UnhookWindowsHookEx RegisterClassA IsDlgButtonChecked GetForegroundWindow GetSysColor GetTopWindow GetDoubleClickTime GetWindowTextA ReleaseDC SetWindowLongA GetMenuCheckMarkDimensions GetDlgItemTextA SetFocus BeginDeferWindowPos IsWindow GetClassNameA SetScrollInfo DeferWindowPos GetSystemMenu GetFocus LoadCursorA GetDC CopyImage EnumDisplayMonitors FillRect GetSystemMetrics

gdi32

GetDIBColorTable ExtTextOutA CreateFontA SelectObject SetTextColor StartDocA GetStockObject Polyline GetDeviceCaps GetTextAlign ExtEscape TextOutA SetBkMode SetTextJustification SetBkColor DeleteObject CreateSolidBrush CreateDCA SetTextAlign SetDCPenColor

winspool.drv

ConnectToPrinterDlg

comdlg32

ChooseFontA

advapi32

SystemFunction036 GetTokenInformation CryptEnumProviderTypesA

shell32

SHBindToParent SHGetPathFromIDListW

ole32

OleCreateStaticFromData CoCreateInstance OleDuplicateData

wininet

InternetOpenUrlW

ws2_32

accept setsockopt WSAStartup getaddrinfo

netapi32

NetWkstaUserGetInfo

avifil32

AVIStreamGetFrameClose

winmm

waveOutWrite waveOutClose waveOutOpen waveOutPrepareHeader

shlwapi

StrCmpNIA SHCreateStreamOnFileEx ord597

pdh

PdhCollectQueryData

gdiplus

GdipDisposeImage GdiplusStartup GdipCloneImage GdipFree GdipGetImageGraphicsContext GdipCreateBitmapFromScan0 GdipAlloc

opengl32

glViewport glNewList glMatrixMode glOrtho glPixelStorei glLoadIdentity

glu32

gluLookAt

powrprof

ReadGlobalPwrPolicy ReadProcessorPwrScheme

urlmon

GetClassFileOrMime

tapi32

lineSetTollListA

esent

JetUpdate JetTruncateLogInstance

Name

.text

Size

118KB

Virtual Size

118KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

39KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

300B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.0MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_Trojan-Ransom.Win32.Shade.nre.9486d121ac4418b351f257bb3a3d09fc

kernel32

user32

gdi32

winspool.drv

comdlg32

advapi32

shell32

ole32

wininet

ws2_32

netapi32

avifil32

winmm

shlwapi

pdh

gdiplus

opengl32

glu32

powrprof

urlmon

tapi32

esent

generic