jaffacakes118_Trojan-Spy[.]Win32[.]SpyEyes[.]izt[.]2c3a61c8053c60710556465ceadc6a2e

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan-Spy.Win32.SpyEyes.izt.2c3a61c8053c60710556465ceadc6a2e
Size 274KB
Sample261018-2yxt2aas4k
SHA256 a202386b30ee89a8d20f6a5d355d694877c3e87eecacc1ddf3e7441efb8c0e9a
MD5 2c3a61c8053c60710556465ceadc6a2e
SHA1 8086d9b9ab1f2f64d67f5dd7c1efda840abf1b54
SHA512 abb0f8fbabb68a7493418113c1836e1ddf2c1a81f2c4a295622d5782b4748694a908c5c61525e698287a439327e553ed10967811456608f562695eb8b8c604d6
SSDEEP 6144:ta+W/1bkvAt4wUn5/sKq9WNKUjaz5NvuoZisZ2Qr0W2Z8N+Os:tabvuNsKEHas4WO8Ns
TLSH
T1B454125356189139F8A00FF8424FE6465C6AB2DB3E62573BAC5E05D82E832530FD778B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
jaffacakes118_Trojan-Spy.Win32.SpyEyes.izt.2c3a61c8053c60710556465ceadc6a2e

File Explorer

jaffacakes118_Trojan-Spy.Win32.SpyEyes.izt.2c3a61c8053c60710556465ceadc6a2e

.exe 274KB

jaffacakes118_Trojan-Spy.Win32.SpyEyes.izt.2c3a61c8053c60710556465ceadc6a2e

IMPHASH 5c1186931da616d4c7a911938df74508
SHA256 a202386b30ee89a8d20f6a5d355d694877c3e87eecacc1ddf3e7441efb8c0e9a
MD5 2c3a61c8053c60710556465ceadc6a2e
SHA1 8086d9b9ab1f2f64d67f5dd7c1efda840abf1b54
SHA512 abb0f8fbabb68a7493418113c1836e1ddf2c1a81f2c4a295622d5782b4748694a908c5c61525e698287a439327e553ed10967811456608f562695eb8b8c604d6
SSDEEP 6144:ta+W/1bkvAt4wUn5/sKq9WNKUjaz5NvuoZisZ2Qr0W2Z8N+Os:tabvuNsKEHas4WO8Ns
TLSH
T1B454125356189139F8A00FF8424FE6465C6AB2DB3E62573BAC5E05D82E832530FD778B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:3 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

6d:d9:af:6c:f5:3a:64:08:91:c6:7e:0b:05:a6:d8:d8:a9:60:2b:e7

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Adobe Systems Incorporated,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Information Systems,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US

Chains

Jul 28, 2010

CN=Adobe Systems Incorporated,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Information Systems,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Serial Number

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

May 21, 2009 - May 20, 2019

Subject

CN=Adobe Systems Incorporated,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Information Systems,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US

Serial Number

4d:4e:dd:77:06:ef:6b:31:31:d0:0b:1c:67:91:d0:c1

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 5, 2009 - Dec 10, 2010

Minor OS version

Major OS version

Entry point

35717

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

IsBadReadPtr CompareFileTime GetCurrentDirectoryW CreatePipe GlobalGetAtomNameW lstrcmpiW GetModuleHandleA CreateEventW lstrcpy OpenSemaphoreW SetPriorityClass GetExpandedNameA GetPriorityClass LoadLibraryA lstrcat FileTimeToDosDateTime CreateThread lstrcmpA SearchPathW FatalAppExitA lstrcatA GetStringTypeW RaiseException GetProcAddress SleepEx CreateNamedPipeW FindResourceW FreeResource FileTimeToSystemTime ExitProcess GetCPInfo IsValidLocale GetEnvironmentVariableW GetTempPathA MoveFileA SystemTimeToFileTime OpenWaitableTimerA TlsAlloc DeleteAtom CreateMutexW GetLastError GetLogicalDriveStringsW LoadLibraryW

user32

GetDlgItemTextW ClientToScreen CopyImage PostMessageW GetWindowTextLengthW ActivateKeyboardLayout GetKeyboardType CharLowerA GetDC BringWindowToTop GetFocus CreateDialogParamW DefDlgProcA GetActiveWindow GetMessageA CheckRadioButton SetWindowLongW GetDCEx GetMenuStringW GetWindowRgn MonitorFromRect CreateAcceleratorTableW EnumDesktopsA IsMenu GetDesktopWindow DialogBoxParamA CreateDesktopA FindWindowA GetActiveWindow CreateDialogIndirectParamW FindWindowW InsertMenuW FillRect GetClassInfoA CheckDlgButton GetSubMenu GetMenuItemRect GetClassLongA EmptyClipboard DestroyCursor SetFocus LoadMenuIndirectA DefDlgProcW

gdi32

GetDCPenColor GetCharABCWidthsW PolyPolyline MoveToEx SetViewportOrgEx CheckColorsInGamut GetObjectW CreateColorSpaceA SelectPalette CreateSolidBrush FontIsLinked AbortDoc SetMiterLimit StartPage GetClipBox GetDIBColorTable CreateFontW CreateMetaFileA GetEnhMetaFileDescriptionW EqualRgn TextOutA PlayEnhMetaFile SetDIBits SetPixelFormat

advapi32

OpenBackupEventLogW CloseEventLog

sqlunirl

_GetUnicodeRedirectionLayer@0 _GrayString_@36 _CreateNamedPipe_@32 _PrivilegedServiceAuditAlarm_@20 _DefineDosDevice_@12 AbortSystemShutdown_ _WaitNamedPipe_@8 _DlgDirList_@20 _CreateColorSpace_@4 _SendDlgItemMessage@20 _QueryServiceLockStatus_@16 _SetFileAttributes_@8 _DefFrameProc_@20 _ResetDC_@8 _GetClassInfoEx_@12

crypt32

CryptUnprotectData CertEnumCRLContextProperties CertVerifyTimeValidity CertAddEncodedCertificateToStore CertFindCTLInStore CertOpenStore I_CryptDetachTls CertDuplicateCertificateContext I_CryptTouchLruEntry CertStrToNameA CertFreeCRLContext I_CryptGetLruEntryData CertOpenSystemStoreW CertFindCertificateInStore RegOpenKeyExU I_CryptFreeTls CryptSIPGetSignedDataMsg PFXExportCertStore I_CryptEnumMatchingLruEntries

Name

.rdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.475\?7

Size

1KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.2/5'/

Size

1024B

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.`<

Size

1KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_MEM_READ

Name

Size

1024B

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.F%\6`7

Size

1KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_MEM_READ

Name

./.

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.@Otk7.

Size

1024B

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

1024B

Virtual Size

2KB

Characteristics

IMAGE_SCN_MEM_READ

Name

.rsrc

Size

220KB

Virtual Size

219KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_Trojan-Spy.Win32.SpyEyes.izt.2c3a61c8053c60710556465ceadc6a2e

PE Signature issue

kernel32

user32

gdi32

advapi32

sqlunirl

crypt32

generic