jaffacakes118_Trojan-Spy[.]Win32[.]Ursnif[.]ycb[.]526b8aaa7ee83f6b44dedbdd145ee39d

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan-Spy.Win32.Ursnif.ycb.526b8aaa7ee83f6b44dedbdd145ee39d
Size 739KB
Sample261018-2656daat2p
SHA256 1c9a64fff52f3884a88657652d8941c0ea70d61198a4f861c022cb5ba32b4813
MD5 526b8aaa7ee83f6b44dedbdd145ee39d
SHA1 0213ab34e8655539e218e2937572203167e33e96
SHA512 069ca359a76bd84db68e6a888bcd1bd022e41da032c825c1006477c2dad37d6f036d74ac520c417a0ab54c4e39007253bbd132be851b4d51b02e8344bbe48dd8
SSDEEP 12288:BP1oOc1k0zIK3OU5KG4/DgOqWkMEqjc00RehQ:joL90KnqrNEs0
TLSH
T103F4F101BAF1C079E4BE42B10DB9DA6A4278BD310B6489FB73C4761E1A325E06E3575F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan-Spy.Win32.Ursnif.ycb.526b8aaa7ee83f6b44dedbdd145ee39d

File Explorer

jaffacakes118_Trojan-Spy.Win32.Ursnif.ycb.526b8aaa7ee83f6b44dedbdd145ee39d

.exe 739KB

jaffacakes118_Trojan-Spy.Win32.Ursnif.ycb.526b8aaa7ee83f6b44dedbdd145ee39d

IMPHASH 8e73b39baa41d00c16a99f3fd8271fd0
SHA256 1c9a64fff52f3884a88657652d8941c0ea70d61198a4f861c022cb5ba32b4813
MD5 526b8aaa7ee83f6b44dedbdd145ee39d
SHA1 0213ab34e8655539e218e2937572203167e33e96
SHA512 069ca359a76bd84db68e6a888bcd1bd022e41da032c825c1006477c2dad37d6f036d74ac520c417a0ab54c4e39007253bbd132be851b4d51b02e8344bbe48dd8
SSDEEP 12288:BP1oOc1k0zIK3OU5KG4/DgOqWkMEqjc00RehQ:joL90KnqrNEs0
TLSH
T103F4F101BAF1C079E4BE42B10DB9DA6A4278BD310B6489FB73C4761E1A325E06E3575F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

321431

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\converting\SW\co.pdb

kernel32

GetFileType CloseHandle GetProcessHeap GetCurrentThreadId GetCPInfo GetOEMCP GetACP IsValidCodePage HeapSize AreFileApisANSI GetModuleHandleExW ExitProcess HeapFree GetModuleFileNameW WriteFile GetStdHandle GetModuleHandleW GetStartupInfoW TlsFree TlsSetValue EnumResourceLanguagesA TlsAlloc WideCharToMultiByte GetCurrentProcess SetLastError SetUnhandledExceptionFilter UnhandledExceptionFilter InitializeCriticalSectionAndSpinCount GetCommandLineA RtlUnwind RaiseException IsProcessorFeaturePresent IsDebuggerPresent DecodePointer GetConsoleCP GetConsoleMode GetModuleFileNameA QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW OutputDebugStringW LoadLibraryExW LCMapStringW HeapReAlloc GetStringTypeW FlushFileBuffers SetStdHandle SetFilePointerEx WriteConsoleW CreateFileW SetEndOfFile ReadFile GetConsoleWindow GetConsoleTitleA MultiByteToWideChar GetDefaultCommConfigA GetFileAttributesA GetModuleHandleA LoadLibraryW LoadLibraryA CreateEventA EncodePointer DeleteCriticalSection LeaveCriticalSection EnterCriticalSection ReadConsoleW InterlockedDecrement InterlockedIncrement TerminateProcess GetTempPathA lstrlenA lstrcpyW GetSystemTimeAdjustment GetTickCount GetSystemTimeAsFileTime GetFileInformationByHandle GetLogicalDrives Sleep WaitForSingleObject GetLastError GetEnvironmentStrings GetCurrentProcessId HeapAlloc GlobalAlloc TlsGetValue GetProcAddress

user32

PostQuitMessage DefWindowProcA EndDialog GetDlgItem CheckRadioButton GetWindowPlacement RegisterClassA ShowWindow IsWindow IsDlgButtonChecked GetDialogBaseUnits OpenClipboard CloseClipboard DialogBoxIndirectParamA SetWindowPos SetWindowPlacement SetClipboardData EmptyClipboard SendMessageA GetMessageA EnumWindowStationsW wsprintfA CreateWindowExA GetAncestor SystemParametersInfoA LoadStringA LoadImageA LoadIconA LoadCursorA GetWindow FindWindowExA FindWindowA SetWindowLongA GetWindowLongA GetSysColorBrush GetCursorPos SetCursor MessageBoxA GetWindowRect GetClientRect GetWindowTextLengthA GetWindowTextA SetWindowTextA ValidateRect InvalidateRect EndPaint BeginPaint ReleaseDC GetDC GetForegroundWindow SetActiveWindow DrawTextA GetMenuItemInfoA AppendMenuA GetSubMenu CheckMenuItem GetSystemMenu GetMenuState GetMenu LoadAcceleratorsA IsWindowEnabled SetTimer SetCapture SetFocus

gdi32

CloseEnhMetaFile SetViewportOrgEx DPtoLP TextOutA MoveToEx GetObjectA CreateDIBSection GetTextMetricsA PlayEnhMetaFileRecord PlayEnhMetaFile GetEnhMetaFileHeader GetEnhMetaFileA DeleteEnhMetaFile CreateEnhMetaFileA BitBlt SetTextJustification SetTextColor SetMapMode SelectObject Rectangle GetStockObject GetPixel GetMapMode GetDeviceCaps DeleteObject DeleteDC CreateSolidBrush CreatePen CreateCompatibleDC CreateCompatibleBitmap

comdlg32

GetOpenFileNameA

advapi32

ImpersonateLoggedOnUser RegOpenKeyExA RegCloseKey

shell32

SHGetDesktopFolder SHGetFileInfoA SHGetSpecialFolderLocation SHGetMalloc ExtractIconExA

ole32

GetHGlobalFromStream ReleaseStgMedium RevokeDragDrop CoLockObjectExternal

oleaut32

OleLoadPicturePath

wininet

DetectAutoProxyUrl FindCloseUrlCache FindFirstUrlCacheEntryA

ws2_32

gethostbyname WSAStartup socket listen accept htonl htons inet_ntoa

msi

ord144

msvfw32

DrawDibOpen ICInfo ICGetInfo ICOpen ICClose ICSendMessage DrawDibClose DrawDibDraw

avifil32

AVIFileGetStream AVIStreamRelease AVIStreamInfoA AVIStreamStart AVIStreamLength AVIFileInfoA AVIStreamGetFrameOpen AVIStreamGetFrame AVIStreamGetFrameClose AVIStreamOpenFromFileA AVIFileOpenA AVIFileRelease AVIStreamSampleToTime AVIFileInit AVIFileExit

winmm

waveInGetErrorTextA

shlwapi

SHCreateStreamOnFileA PathCompactPathA StrRetToBufA

wintrust

OpenPersonalTrustDBDialog

imm32

ImmEscapeA

tapi32

phoneGetLamp phoneGetRing