jaffacakes118_2a2a5a179b8404da81eaa5d1794ee184b773a5fdbeeef91e3b63c3e8d2f479c7[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_2a2a5a179b8404da81eaa5d1794ee184b773a5fdbeeef91e3b63c3e8d2f479c7.bin
Size 262KB
Sample261018-sfe2tses5j
SHA256 2a2a5a179b8404da81eaa5d1794ee184b773a5fdbeeef91e3b63c3e8d2f479c7
MD5 7aa2d05953f0be44e7c73957dbec708f
SHA1 b6d552e4e96f1a8d56bdbd03015b1d3faa1042ed
SHA512 fc53fdd6dee17476af167b641f29b0ca352b0618f2adc63af052f600fe9121126404b4fcbed16b6a7bcd4348f61de872c185972b4705c504d9f24840cb27dc0d
SSDEEP 3072:13FKK+qOLpWZOpHwOnxjhI1a29nMGkvmUCDzTObdPnF5od1Jc+mTSC/REMz5hMBM:19+qOLoaXjhenMGmmUEebVF+uoi6y6te
TLSH
T1C84427116D918072E1BA1A30E5BC7A7159697FF80B3088DF53B43E2E3F352E29535B62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

jaffacakes118_2a2a5a179b8404da81eaa5d1794ee184b773a5fdbeeef91e3b63c3e8d2f479c7.bin

.exe 262KB

jaffacakes118_2a2a5a179b8404da81eaa5d1794ee184b773a5fdbeeef91e3b63c3e8d2f479c7.bin

IMPHASH 959a6730bc071cd048c8e4c56109bff6
SHA256 2a2a5a179b8404da81eaa5d1794ee184b773a5fdbeeef91e3b63c3e8d2f479c7
MD5 7aa2d05953f0be44e7c73957dbec708f
SHA1 b6d552e4e96f1a8d56bdbd03015b1d3faa1042ed
SHA512 fc53fdd6dee17476af167b641f29b0ca352b0618f2adc63af052f600fe9121126404b4fcbed16b6a7bcd4348f61de872c185972b4705c504d9f24840cb27dc0d
SSDEEP 3072:13FKK+qOLpWZOpHwOnxjhI1a29nMGkvmUCDzTObdPnF5od1Jc+mTSC/REMz5hMBM:19+qOLoaXjhenMGmmUEebVF+uoi6y6te
TLSH
T1C84427116D918072E1BA1A30E5BC7A7159697FF80B3088DF53B43E2E3F352E29535B62
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

6f:56:49:0a:fb:07:8d:fa:da:f8:2a:7e:17:78:96:b3:71:14:ca:2a:16:7c:fe:e8:5d:c9:8b:47:3d:c5:72:97

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Avast Software s.r.o.,OU=RE stapler cistodc,O=Avast Software s.r.o.,L=Praha,C=CZ

Chains

Nov 14, 2022

CN=Avast Software s.r.o.,OU=RE stapler cistodc,O=Avast Software s.r.o.,L=Praha,C=CZ

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=Avast Software s.r.o.,OU=RE stapler cistodc,O=Avast Software s.r.o.,L=Praha,C=CZ

Serial Number

09:70:ef:4b:ad:5c:c4:4a:1c:2b:c3:d9:64:01:67:4c

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 2, 2020 - Mar 9, 2023

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

4128

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\BUILD\work\8b0ebd312dc47f30\projects\avast\microstub\x86\Release\microstub.pdb

kernel32

SetLastError Sleep GetFileSizeEx WriteFile SetEndOfFile SetFilePointerEx LocalFree CloseHandle MapViewOfFile UnmapViewOfFile CreateFileMappingW EnumResourceNamesW GetWindowsDirectoryW CreateDirectoryW CreateFileW CreateThread GetSystemTimeAsFileTime GetNativeSystemInfo lstrcatA lstrlenA GetVersionExA GetCurrentProcess GetExitCodeProcess ResumeThread ReleaseMutex WaitForSingleObject CreateMutexW CreateProcessW GetPrivateProfileIntW GetPrivateProfileStringW GetDiskFreeSpaceExW CopyFileW MoveFileExW CreateHardLinkW HeapAlloc GetProcessHeap HeapSetInformation ExitProcess IsProcessorFeaturePresent lstrcpyW GetModuleHandleW GetSystemDirectoryW SetDllDirectoryW InterlockedExchange LockResource WriteConsoleW FlushFileBuffers GetConsoleMode GetConsoleCP SetStdHandle LCMapStringW FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP IsValidCodePage FindNextFileW GetLastError HeapFree InterlockedExchangeAdd GetVersionExW FindResourceW LoadLibraryW SizeofResource LoadResource GlobalFree GlobalUnlock GlobalLock FindFirstFileExW FindClose GlobalAlloc FreeLibrary RaiseException GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA DecodePointer GetVersion HeapDestroy HeapReAlloc HeapSize InitializeCriticalSectionAndSpinCount DeleteCriticalSection DeviceIoControl GetVolumeNameForVolumeMountPointW GetVolumePathNameW MultiByteToWideChar WideCharToMultiByte EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent WaitForSingleObjectEx CreateEventW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW TerminateProcess OutputDebugStringW RtlUnwind EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetCommandLineA GetCommandLineW GetStdHandle GetModuleFileNameW GetModuleHandleExW GetACP GetStringTypeW GetFileType GetProcAddress

user32

GetMessageW TranslateMessage DispatchMessageW AllowSetForegroundWindow PostMessageW wsprintfA LoadStringW MessageBoxExW wsprintfW SystemParametersInfoW IsDialogMessageW LoadImageW DestroyIcon FindWindowW FillRect InvalidateRect EndPaint BeginPaint ReleaseDC GetDC SetForegroundWindow GetSystemMetrics KillTimer SetTimer SetFocus SetWindowPos DestroyWindow CreateWindowExW RegisterClassExW PostQuitMessage DefWindowProcW SendMessageW

gdi32

GetTextExtentPoint32W GetObjectW CreateDIBSection SelectObject CreateFontIndirectW DeleteObject CreateSolidBrush CreatePatternBrush

advapi32

CryptDestroyHash CryptHashData CryptCreateHash CryptGenRandom CryptGetHashParam CryptReleaseContext CryptAcquireContextA GetSidSubAuthorityCount GetSidSubAuthority IsValidSid GetTokenInformation OpenProcessToken ConvertStringSecurityDescriptorToSecurityDescriptorA

ole32

CoCreateInstance CreateStreamOnHGlobal CoInitializeEx

comctl32

ord17

Name

.text

Size

132KB

Virtual Size

132KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

40KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

512B

Virtual Size

76B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

69KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_2a2a5a179b8404da81eaa5d1794ee184b773a5fdbeeef91e3b63c3e8d2f479c7.bin

kernel32

user32

gdi32

advapi32

ole32

comctl32

generic