jaffacakes118_Trojan[.]Win32[.]ConnectionServices[.]e[.]90cfe636a375a60bc000856540b76aff

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan.Win32.ConnectionServices.e.90cfe636a375a60bc000856540b76aff
Size 34KB
Sample261018-2g155ach63
SHA256 fbb41b8af7735c192de42932ab75daa352044329ba43c1bf4938ab434629c7a1
MD5 90cfe636a375a60bc000856540b76aff
SHA1 91c342a3444dc753d7350735df9b3427dd8fb47e
SHA512 9d864cf81b9e36946913c2e08dc158438eb32b5c99fb69ffaf60a936dd8ecd4600bd6c9be9eb4bf69c72465f9123f98220a9f7e928fe8bf0e9b7d8c2171e1faa
SSDEEP 768:xAHOxV48YibkD7Qb4jjdSGIiKMQ/0ZVWc:xkOx6su7Qb4jjdSGIiKMQ/0ZVW
TLSH
T1E9F2716AB6538FE1E2D28430CBF74D4E7EB1BD613928576316880D3F1E34A91C82761D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan.Win32.ConnectionServices.e.90cfe636a375a60bc000856540b76aff

File Explorer

jaffacakes118_Trojan.Win32.ConnectionServices.e.90cfe636a375a60bc000856540b76aff

.exe 34KB

jaffacakes118_Trojan.Win32.ConnectionServices.e.90cfe636a375a60bc000856540b76aff

IMPHASH bfc7c703daacfe124360911fc5b2ce45
SHA256 fbb41b8af7735c192de42932ab75daa352044329ba43c1bf4938ab434629c7a1
MD5 90cfe636a375a60bc000856540b76aff
SHA1 91c342a3444dc753d7350735df9b3427dd8fb47e
SHA512 9d864cf81b9e36946913c2e08dc158438eb32b5c99fb69ffaf60a936dd8ecd4600bd6c9be9eb4bf69c72465f9123f98220a9f7e928fe8bf0e9b7d8c2171e1faa
SSDEEP 768:xAHOxV48YibkD7Qb4jjdSGIiKMQ/0ZVWc:xkOx6su7Qb4jjdSGIiKMQ/0ZVW
TLSH
T1E9F2716AB6538FE1E2D28430CBF74D4E7EB1BD613928576316880D3F1E34A91C82761D
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10446

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

mfc42

ord641 ord324 ord825 ord2302 ord4234 ord537 ord823 ord815 ord1575 ord561 ord6055 ord1776 ord5290 ord3402 ord4424 ord3721 ord3619 ord800 ord795 ord858 ord3597 ord540 ord567 ord3663 ord3626 ord2414 ord4275 ord2379 ord755 ord6172 ord5875 ord5789 ord470 ord6453 ord3874 ord4284 ord1641 ord2864 ord613 ord289 ord2860 ord4425 ord4627 ord4080 ord3079 ord3825 ord3831 ord3830 ord2976 ord3081 ord2985 ord3262 ord3136 ord4465 ord3259 ord3147 ord2982 ord5277 ord2124 ord2446 ord5261 ord1727 ord5065 ord3749 ord6376 ord2055 ord2648 ord4441 ord4837 ord3798 ord5280 ord4353 ord6374 ord5163 ord2385 ord5241 ord4407 ord1775 ord4078 ord6052 ord2514 ord4710 ord4998 ord4853 ord4376 ord860 ord5265

msvcrt

_except_handler3 __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _acmdln exit _XcptFilter _exit ??1type_info@@UAE@XZ _onexit __dllonexit _CxxThrowException _purecall strcat strlen strcpy sprintf memset __CxxFrameHandler _controlfp

kernel32

CreateProcessA CreateFileA WriteFile CreateThread CloseHandle InterlockedDecrement InterlockedIncrement EnterCriticalSection UnmapViewOfFile LockResource InitializeCriticalSection DeleteCriticalSection CreateEventA WaitForSingleObject lstrlenA lstrcpyA GetModuleHandleA GetStartupInfoA SizeofResource LoadResource FindResourceA DeleteFileA GetTempFileNameA GetTempPathA Sleep LeaveCriticalSection MapViewOfFile GetLastError CreateFileMappingA CreateMutexA GetVersionExA

user32

UpdateWindow ShowWindow CreateWindowExA RegisterClassA DefWindowProcA SetForegroundWindow GetMessageA TranslateMessage MessageBoxA RegisterWindowMessageA SendMessageA GetParent SetCursor LoadCursorA EnableWindow CreatePopupMenu InsertMenuItemA PostQuitMessage GetCursorPos TrackPopupMenu GetSystemMetrics LoadImageA DispatchMessageA DestroyMenu

gdi32

GetStockObject GetTextExtentPoint32A CreateFontIndirectA GetObjectA

advapi32

SetSecurityDescriptorDacl InitializeSecurityDescriptor RegCloseKey RegQueryValueExA RegOpenKeyExA

shell32

Shell_NotifyIconA ShellExecuteA

comctl32

_TrackMouseEvent

shlwapi

PathFileExistsA