jaffacakes118_Trojan[.]Win32[.]Chapak[.]auzp[.]f0c9783d5596d50607dd0b8caa386b2a

General

Target
jaffacakes118_Trojan.Win32.Chapak.auzp.f0c9783d5596d50607dd0b8caa386b2a
Size 2.3MB
Sample261018-16bfbsbs6v
SHA256 21c6f87ddf024ffe95acec742092392d718dd28013b91970e7c993188261f05a
MD5 f0c9783d5596d50607dd0b8caa386b2a
SHA1 a2881b53e5e8780f53431e65fe38fbca4ab90cb4
SHA512 43981aaa425d53fd80d9d7dcbefbfe584113038d600d9e59213ef9b761990b14addb491d9f40add4b71220479ab64f6bb0fa2624a324896b4cf8e978bd0311e7
SSDEEP 24576:qoJI4qsy3lFF0qLnIhIP5tyWMG9m6NjkHU/bX22:rI4qsybF0qLnNP5NMG5kHU/bt
TLSH
T1A8B51210B980CC32E5A359330875EABB153DFB045F216C9BB3A8076D5FAC1D46E36D6A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan.Win32.Chapak.auzp.f0c9783d5596d50607dd0b8caa386b2a

File Explorer

jaffacakes118_Trojan.Win32.Chapak.auzp.f0c9783d5596d50607dd0b8caa386b2a

.exe 2.3MB

jaffacakes118_Trojan.Win32.Chapak.auzp.f0c9783d5596d50607dd0b8caa386b2a

IMPHASH 779c36a6530698a001db2e77cc8a39bd
SHA256 21c6f87ddf024ffe95acec742092392d718dd28013b91970e7c993188261f05a
MD5 f0c9783d5596d50607dd0b8caa386b2a
SHA1 a2881b53e5e8780f53431e65fe38fbca4ab90cb4
SHA512 43981aaa425d53fd80d9d7dcbefbfe584113038d600d9e59213ef9b761990b14addb491d9f40add4b71220479ab64f6bb0fa2624a324896b4cf8e978bd0311e7
SSDEEP 24576:qoJI4qsy3lFF0qLnIhIP5tyWMG9m6NjkHU/bX22:rI4qsybF0qLnNP5NMG5kHU/bt
TLSH
T1A8B51210B980CC32E5A359330875EABB153DFB045F216C9BB3A8076D5FAC1D46E36D6A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

34169

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetModuleHandleW VirtualProtect GetLastError CreateIoCompletionPort DeleteCriticalSection InitializeCriticalSectionAndSpinCount CloseHandle VerifyVersionInfoW VerSetConditionMask WaitForSingleObject QueueUserAPC TerminateThread InterlockedExchangeAdd WaitForMultipleObjects InterlockedDecrement GetQueuedCompletionStatus SetWaitableTimer InterlockedExchange InterlockedIncrement PostQueuedCompletionStatus InterlockedCompareExchange SetLastError LeaveCriticalSection EnterCriticalSection TlsFree TlsAlloc TlsSetValue TlsGetValue LocalFree FormatMessageA DecodePointer WriteConsoleW SetFilePointerEx GetConsoleMode GetConsoleCP FlushFileBuffers HeapReAlloc HeapSize SetStdHandle GetFileType GetProcessHeap SetEnvironmentVariableA FreeEnvironmentStringsW SetEvent ResetEvent WaitForSingleObjectEx CreateEventW GetProcAddress UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead EncodePointer RaiseException RtlUnwind FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameA MultiByteToWideChar WideCharToMultiByte GetStdHandle WriteFile GetCommandLineA GetCommandLineW GetACP HeapFree HeapAlloc GetStringTypeW CompareStringW LCMapStringW FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetEnvironmentStringsW CreateFileW

ws2_32

WSARecv WSASocketW bind listen htons setsockopt ioctlsocket WSASetLastError WSAGetLastError closesocket WSAStartup WSACleanup WSASend

mswsock

GetAcceptExSockaddrs AcceptEx

Name

.text

Size

2.1MB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

33KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

296B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

140KB

Virtual Size

139KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_Trojan.Win32.Chapak.auzp.f0c9783d5596d50607dd0b8caa386b2a

kernel32

ws2_32

mswsock

generic