jaffacakes118_Trojan[.]Win32[.]Poweliks[.]adyu[.]5ecb3f4f1802175305f69e8e5419bfc0

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan.Win32.Poweliks.adyu.5ecb3f4f1802175305f69e8e5419bfc0
Size 475KB
Sample261018-sr3x2abe74
SHA256 9fa6751eddc64b79c26fca5054613e1bf150297ce0440097df662095daec5bc0
MD5 5ecb3f4f1802175305f69e8e5419bfc0
SHA1 29b316704dbe5a9914259670391f0c1394e8e59d
SHA512 83c7ed47a5c254d9236b596f4cb9569243b4937b6ace61739af1103235108f8d03817d1f97271299f69ebcf7c626a083841084ab0d329bbe8aa9dfba18315785
SSDEEP 6144:e8SLao7uWAOGUA69pbCSsmQWMt1dkHFY8F8cqYP41BnbKnEGKLZWx:e8SOo6cpCLKu82DYP41l+nEGK1A
TLSH
T19FA4F18A93D443F1E6D726F00E6A9B3FCB669D43066985838798DE537AB33E18C17311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan.Win32.Poweliks.adyu.5ecb3f4f1802175305f69e8e5419bfc0

File Explorer

jaffacakes118_Trojan.Win32.Poweliks.adyu.5ecb3f4f1802175305f69e8e5419bfc0

.exe 475KB

jaffacakes118_Trojan.Win32.Poweliks.adyu.5ecb3f4f1802175305f69e8e5419bfc0

IMPHASH 734368641bed34476f4a7138a22e560b
SHA256 9fa6751eddc64b79c26fca5054613e1bf150297ce0440097df662095daec5bc0
MD5 5ecb3f4f1802175305f69e8e5419bfc0
SHA1 29b316704dbe5a9914259670391f0c1394e8e59d
SHA512 83c7ed47a5c254d9236b596f4cb9569243b4937b6ace61739af1103235108f8d03817d1f97271299f69ebcf7c626a083841084ab0d329bbe8aa9dfba18315785
SSDEEP 6144:e8SLao7uWAOGUA69pbCSsmQWMt1dkHFY8F8cqYP41BnbKnEGKLZWx:e8SOo6cpCLKu82DYP41l+nEGK1A
TLSH
T19FA4F18A93D443F1E6D726F00E6A9B3FCB669D43066985838798DE537AB33E18C17311
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

16298

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

advapi32

CloseEventLog CloseServiceHandle CloseEncryptedFileRaw ChangeServiceConfig2W ClearEventLogA ControlService

shlwapi

PathRemoveFileSpecW PathFindFileNameW PathIsUNCW PathFindExtensionW

winspool.drv

AddPortA AddJobA

gdi32

CreatePen SelectObject SetBkColor SetWindowExtEx DeleteObject SetViewportExtEx GetClipBox ScaleViewportExtEx CreateBitmap GetStockObject SetViewportOrgEx TranslateCharsetInfo SaveDC SetMapMode SetTextColor RestoreDC GetTextExtentPoint32W SetBkMode

user32

GetMenuItemCount SetTimer GetClientRect SetWindowsHookExW ShowWindow MessageBoxW GetLastActivePopup GrayStringW IsWindowVisible GetCapture GetSysColorBrush SetWindowTextW SetPropW GetTopWindow GetCursorPos GetMenu BeginPaint GetForegroundWindow GetWindowThreadProcessId GetClassInfoExW GetMessagePos IntersectRect GetMenuCheckMarkDimensions EnableWindow LoadIconW KillTimer GetSysColor GetDlgItem GetWindowRect GetDC CopyRect SetWindowPos IsWindowEnabled GetWindow RemovePropW LoadBitmapW SetFocus GetParent EndPaint PostQuitMessage ClientToScreen GetClassLongW GetWindowLongW DestroyIcon UpdateWindow PeekMessageW ScreenToClient GetNextDlgTabItem DestroyMenu ValidateRect RegisterClassW GetDesktopWindow TrackPopupMenu ReleaseDC MonitorFromWindow InvalidateRect SetActiveWindow CreatePopupMenu GetFocus RegisterWindowMessageW GetMessageTime GetKeyState EnableMenuItem GetSystemMetrics SetCursor CharToOemA GetSubMenu CreateWindowExW MapWindowPoints DispatchMessageW GetPropW LoadCursorW SetForegroundWindow EndDialog GetClassNameW GetDlgCtrlID

shell32

CommandLineToArgvW RealShellExecuteExW SHEnumerateUnreadMailAccountsW SHAddToRecentDocs

ole32

CoCreateGuid CoUninitialize

kernel32

WriteFile CreateDirectoryW GetModuleHandleW InitializeSListHead LeaveCriticalSection SystemTimeToFileTime OutputDebugStringW DeleteFileW GetCommandLineA QueryPerformanceCounter MoveFileW FreeResource LocalAlloc MulDiv Sleep WaitForSingleObject GlobalAlloc SetLastError EnumSystemLocalesW GetVolumeInformationW GetStringTypeW LoadLibraryW InitializeCriticalSection GetLastError GetThreadPriority ReadFile DeleteCriticalSection SwitchToThread GetModuleFileNameA CreateThread GetProcessHeap OutputDebugStringA LocalReAlloc DuplicateHandle GetFileTime GlobalLock HeapSize SetEvent FindResourceW WriteConsoleW FileTimeToLocalFileTime TlsGetValue CreateEventW GetModuleHandleA GetCurrentThread GetLocaleInfoW SetStdHandle FindClose LoadResource VirtualProtect GetFullPathNameW WaitForSingleObjectEx SetEndOfFile LocalFree GlobalReAlloc GetCurrentProcess LockResource CreateTimerQueueTimer GetStdHandle GetConsoleCP GlobalAddAtomW CloseHandle RemoveDirectoryW GetLongPathNameW VirtualFree GetCurrentThreadId CreateFileW HeapReAlloc TlsFree EnterCriticalSection AreFileApisANSI GetProcessAffinityMask GetACP InterlockedIncrement TlsSetValue GetSystemDirectoryW SetFileTime DeleteTimerQueueTimer SizeofResource SetUnhandledExceptionFilter GlobalUnlock GetEnvironmentStringsW IsDebuggerPresent GetFileSize LocalFileTimeToFileTime CreateTimerQueue GetModuleFileNameW GetFileType FormatMessageW IsDBCSLeadByteEx LCMapStringW GetModuleHandleExW GetCPInfo GetProcAddress lstrcmpA HeapFree GlobalFlags ExitProcess GetUserDefaultLCID UnlockFile SetThreadPriority FreeEnvironmentStringsW GetFileSizeEx SetFileAttributesW HeapAlloc ReadConsoleW IsDBCSLeadByte FindNextFileW SetFilePointer LoadLibraryA RaiseException

Name

.text

Size

75KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

205KB

Virtual Size

204KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

164KB

Virtual Size

164KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

1024B

Virtual Size

768B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_Trojan.Win32.Poweliks.adyu.5ecb3f4f1802175305f69e8e5419bfc0

advapi32

shlwapi

winspool.drv

gdi32

user32

shell32

ole32

kernel32

generic