jaffacakes118_Trojan-Spy[.]Win32[.]Ursnif[.]zvb[.]37643500561d36f1bda903dd3f4beedb

General

Target
jaffacakes118_Trojan-Spy.Win32.Ursnif.zvb.37643500561d36f1bda903dd3f4beedb
Size 140KB
Sample261018-27rdlsat3m
SHA256 a336212fecd29ce983db644b088505b674ebc7a12e1914cbcb484aea5a0c4a08
MD5 37643500561d36f1bda903dd3f4beedb
SHA1 baf012b544c3c463349900a6331e207565575f11
SHA512 f3be83d7f5228dbbd2f9cdf156dbc93448d4626a33917faf628acd2c2a3b2d7237228fa4e76605fe57fa7dc3c49de075cc08b55ed881d8ec01dd2abfdfc33d89
SSDEEP 3072:BB/F/LfzCyWeFfpzcNZiSDbUXBx0gBNsb:BB/FDfzCy/Ffp4O2be6
TLSH
T1F5E3CF22B1D088BAC4A2253154A0E9A24FBFB91A5B79419F7BD9177D4F607D00F3638F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan-Spy.Win32.Ursnif.zvb.37643500561d36f1bda903dd3f4beedb

File Explorer

jaffacakes118_Trojan-Spy.Win32.Ursnif.zvb.37643500561d36f1bda903dd3f4beedb

.exe 140KB

jaffacakes118_Trojan-Spy.Win32.Ursnif.zvb.37643500561d36f1bda903dd3f4beedb

IMPHASH cff1a92202d9c9efb083bb7b3a7c115c
SHA256 a336212fecd29ce983db644b088505b674ebc7a12e1914cbcb484aea5a0c4a08
MD5 37643500561d36f1bda903dd3f4beedb
SHA1 baf012b544c3c463349900a6331e207565575f11
SHA512 f3be83d7f5228dbbd2f9cdf156dbc93448d4626a33917faf628acd2c2a3b2d7237228fa4e76605fe57fa7dc3c49de075cc08b55ed881d8ec01dd2abfdfc33d89
SSDEEP 3072:BB/F/LfzCyWeFfpzcNZiSDbUXBx0gBNsb:BB/FDfzCy/Ffp4O2be6
TLSH
T1F5E3CF22B1D088BAC4A2253154A0E9A24FBFB91A5B79419F7BD9177D4F607D00F3638F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

9076

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

TerminateProcess GetStartupInfoW FillConsoleOutputCharacterW GetLastError SetLastError LoadLibraryA FindNextChangeNotification AddAtomA FindAtomA VirtualProtect GetFileInformationByHandle GetThreadTimes LocalFree lstrcpyA RtlUnwind GlobalAlloc Sleep GetStringTypeW MultiByteToWideChar LCMapStringW WideCharToMultiByte GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameW GetStdHandle WriteFile LoadLibraryW EnterCriticalSection EnumTimeFormatsW GetTickCount GetModuleHandleW FindCloseChangeNotification FindFirstChangeNotificationW GetCPInfo ExitProcess LeaveCriticalSection DeleteCriticalSection HeapSize InitializeCriticalSectionAndSpinCount HeapCreate HeapReAlloc GetProcAddress DecodePointer GetCommandLineW HeapSetInformation RaiseException GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc HeapFree IsProcessorFeaturePresent EncodePointer InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree GetCurrentThreadId

user32

GetMenuState GetAltTabInfoW GetDesktopWindow SwitchDesktop

shell32

ExtractIconW

Sharing