jaffacakes118_Trojan[.]Win32[.]Cosmu[.]dnej[.]a4ad6d70afb6d6dcfb771

General

Target
jaffacakes118_Trojan.Win32.Cosmu.dnej.a4ad6d70afb6d6dcfb771
Size 267KB
Sample261018-2mxpwsch76
SHA256 0622f0b44017602a4b64e56df0dd5d94cfdaa646f1be272194fffb36b590b760
MD5 8fceddb73a6a4ad6d70afb6d6dcfb771
SHA1 4f4fa6490e4e301a977f37b097732ab1cbf537c4
SHA512 6b2d21c0eb7684d00a3d317d4aeba13f9db5f986d21420aab8970b08caf39fe809162041daf5395a2a711467ae2e8fe7f9b13ccf353b6f6231955d8e3c45948b
SSDEEP 3072:/PP3tGXRvjxCb5NgXDY7uSlkJcUa7kYQTcqW2NdQQGH/UDhSCUc4aqTBrgmQ+:3IlKgzelZNQSBQGH/CSpWqTKmQ
TLSH
T15C44F14179B2C4B3D44286764CAACB61B737AD039A60C143BBAD0F8B5F712D49B2B349
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan.Win32.Cosmu.dnej.a4ad6d70afb6d6dcfb771

File Explorer

jaffacakes118_Trojan.Win32.Cosmu.dnej.a4ad6d70afb6d6dcfb771

.exe 267KB

jaffacakes118_Trojan.Win32.Cosmu.dnej.a4ad6d70afb6d6dcfb771

IMPHASH 5aa33c577ffd8431ff254de85dee5e7b
SHA256 0622f0b44017602a4b64e56df0dd5d94cfdaa646f1be272194fffb36b590b760
MD5 8fceddb73a6a4ad6d70afb6d6dcfb771
SHA1 4f4fa6490e4e301a977f37b097732ab1cbf537c4
SHA512 6b2d21c0eb7684d00a3d317d4aeba13f9db5f986d21420aab8970b08caf39fe809162041daf5395a2a711467ae2e8fe7f9b13ccf353b6f6231955d8e3c45948b
SSDEEP 3072:/PP3tGXRvjxCb5NgXDY7uSlkJcUa7kYQTcqW2NdQQGH/UDhSCUc4aqTBrgmQ+:3IlKgzelZNQSBQGH/CSpWqTKmQ
TLSH
T15C44F14179B2C4B3D44286764CAACB61B737AD039A60C143BBAD0F8B5F712D49B2B349
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

12335

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_ISOLATION

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

f:\workplace\c++\hannibal\release\hannibal.pdb

kernel32

CreateFileA GetFileSize FindResourceA SetFilePointer FreeLibrary LoadResource UpdateResourceA SetFileTime WriteFile GetDriveTypeA SizeofResource GetFileAttributesA ReadFile MultiByteToWideChar FindFirstFileA GetLastError CopyFileA SetFileAttributesA FindClose LockResource BeginUpdateResourceA GetModuleFileNameA FindNextFileA LoadLibraryExA EnumResourceNamesA GetFileTime EndUpdateResourceA WinExec CloseHandle DeleteFileA CompareStringW CompareStringA FlushFileBuffers GetTimeFormatA GetDateFormatA GetSystemTimeAsFileTime GetCommandLineA HeapFree GetVersionExA HeapAlloc GetProcessHeap GetStartupInfoA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetProcAddress GetModuleHandleA TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement GetCPInfo GetACP GetOEMCP Sleep WideCharToMultiByte GetTimeZoneInformation RaiseException ExitProcess GetStdHandle FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType DeleteCriticalSection HeapDestroy HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetConsoleCP GetConsoleMode EnterCriticalSection LeaveCriticalSection LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA VirtualAlloc HeapReAlloc HeapSize LoadLibraryA InitializeCriticalSection RtlUnwind SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW SetEnvironmentVariableA

ole32

CoUninitialize CoCreateInstance CoInitialize

Sharing