jaffacakes118_Trojan-Spy[.]Win32[.]Waruiko[.]e[.]c474d7570130c4881a6e7948f5d3249f

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan-Spy.Win32.Waruiko.e.c474d7570130c4881a6e7948f5d3249f
Size 23KB
Sample261018-3ch97atz3p
SHA256 8d2c22404db44fc3c9bc396f502047fe2d54415d67d7692d712452738645ae77
MD5 c474d7570130c4881a6e7948f5d3249f
SHA1 07286846a8d70e82c2bbdb780818a4ba959e72c1
SHA512 3a29ad4daabb2efbb1b2aff772a8d64950164fb7d1af47528e2d99b55733367862ac9d017916f024562fd9139823a5ce5eb8a361f18de11a24db969319f10665
SSDEEP 384:T7bmRqdjQsIhLl6mVploCrmxV02ApzouVOKI8lzDt/0:nCRij04AclxO2mhlF
TLSH
T13FB2B6137206D2F3C6228870C28BA9FE5B35DD22C69A842FDBD1FD1CB537661711E25A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan-Spy.Win32.Waruiko.e.c474d7570130c4881a6e7948f5d3249f

File Explorer

jaffacakes118_Trojan-Spy.Win32.Waruiko.e.c474d7570130c4881a6e7948f5d3249f

.exe 23KB

jaffacakes118_Trojan-Spy.Win32.Waruiko.e.c474d7570130c4881a6e7948f5d3249f

IMPHASH 6cbf70d87c621af4a2ea3df422132b08
SHA256 8d2c22404db44fc3c9bc396f502047fe2d54415d67d7692d712452738645ae77
MD5 c474d7570130c4881a6e7948f5d3249f
SHA1 07286846a8d70e82c2bbdb780818a4ba959e72c1
SHA512 3a29ad4daabb2efbb1b2aff772a8d64950164fb7d1af47528e2d99b55733367862ac9d017916f024562fd9139823a5ce5eb8a361f18de11a24db969319f10665
SSDEEP 384:T7bmRqdjQsIhLl6mVploCrmxV02ApzouVOKI8lzDt/0:nCRij04AclxO2mhlF
TLSH
T13FB2B6137206D2F3C6228870C28BA9FE5B35DD22C69A842FDBD1FD1CB537661711E25A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4720

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

ws2_32

WSAGetLastError WSAStartup bind closesocket connect gethostbyaddr gethostbyname gethostname getservbyname htons inet_addr listen recv send sendto setsockopt socket

advapi32

RegCloseKey RegCreateKeyExA RegDeleteKeyA RegEnumKeyA RegOpenKeyExA RegQueryValueExA RegSetValueExA

kernel32

AddAtomA CloseHandle CopyFileA CreateDirectoryA CreateFileA CreateMutexA DeleteFileA ExitProcess FindAtomA FindFirstFileA FindNextFileA FindResourceA FlushFileBuffers FormatMessageA FreeResource GetAtomNameA GetCommandLineA GetLastError GetModuleHandleA GetProcAddress GetStartupInfoA GetSystemDefaultLangID GetSystemDirectoryA GetSystemTime LoadLibraryA LoadResource LockResource ReadFile SetFilePointer SetUnhandledExceptionFilter SizeofResource Sleep VerLanguageNameA WinExec WriteFile

msvcrt

__getmainargs __p__environ __p__fmode __set_app_type _cexit _iob _onexit _setmode _vsnprintf abort atexit atoi fclose fflush fopen fprintf fread free fseek ftell fwrite malloc memcpy memset rewind signal sprintf strcat strcmp strcpy strlen strncmp

user32

CreateWindowExA DefWindowProcA DispatchMessageA GetMessageA LoadCursorA LoadIconA PostQuitMessage RegisterClassExA SetTimer ShowWindow TranslateMessage

Name

.text

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

80B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

1024B

Virtual Size

976B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

912B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_Trojan-Spy.Win32.Waruiko.e.c474d7570130c4881a6e7948f5d3249f

ws2_32

advapi32

kernel32

msvcrt

user32

generic