jaffacakes118_Trojan[.]Win32[.]Skillis[.]iot[.]9c65683389b8a3836b3e27fb8396eb72

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan.Win32.Skillis.iot.9c65683389b8a3836b3e27fb8396eb72
Size 254KB
Sample261018-swa3tabe86
SHA256 63ca576fa6dad36503c55750b0f930c34d1b660beb9d8268fdd12b4b0e96bee7
MD5 9c65683389b8a3836b3e27fb8396eb72
SHA1 5804c2831e05bfde3c55ca38ffc980837612f0c8
SHA512 3317cd28f315b8ec7af4f2b6c72a22ec6a00f374ce31ea2439f6efaf990ed242f3c9c1dcc9bf224cb89d6b984d9eaeed39b45f22ca1ebd6d7b6f33df2425206b
SSDEEP 3072:KD5o6Hv3kaWFXqioZ7ranJ5fDtg36r4vYQ8+JGSNimVGEY6UWEZbUWEZbUJ:P68DqwnPr0vY+f6b6UWEZbUWEZbUJ
TLSH
T138447C0172C3C172E3EF413599A3D61567BABA12AF63BAF727905F4A1D30985C9F2702
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan.Win32.Skillis.iot.9c65683389b8a3836b3e27fb8396eb72

File Explorer

jaffacakes118_Trojan.Win32.Skillis.iot.9c65683389b8a3836b3e27fb8396eb72

.dll 254KB

jaffacakes118_Trojan.Win32.Skillis.iot.9c65683389b8a3836b3e27fb8396eb72

IMPHASH d26e2306a237249bba54d4531db835b4
SHA256 63ca576fa6dad36503c55750b0f930c34d1b660beb9d8268fdd12b4b0e96bee7
MD5 9c65683389b8a3836b3e27fb8396eb72
SHA1 5804c2831e05bfde3c55ca38ffc980837612f0c8
SHA512 3317cd28f315b8ec7af4f2b6c72a22ec6a00f374ce31ea2439f6efaf990ed242f3c9c1dcc9bf224cb89d6b984d9eaeed39b45f22ca1ebd6d7b6f33df2425206b
SSDEEP 3072:KD5o6Hv3kaWFXqioZ7ranJ5fDtg36r4vYQ8+JGSNimVGEY6UWEZbUWEZbUJ:P68DqwnPr0vY+f6b6UWEZbUWEZbUJ
TLSH
T138447C0172C3C172E3EF413599A3D61567BABA12AF63BAF727905F4A1D30985C9F2702
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

70175

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

mcy.pdb

kernel32

CreateMutexW ReleaseMutex CreateThread GetCurrentProcessId ResetEvent CreateEventW SetEvent EnterCriticalSection LeaveCriticalSection InterlockedIncrement InterlockedDecrement lstrcmpiW FreeLibrary MultiByteToWideChar LoadLibraryExW FileTimeToSystemTime LocalFileTimeToFileTime DisableThreadLibraryCalls lstrcpynW WriteFile CreateFileW DeleteFileW ReadFile GetFileSize GetTempFileNameW CreateMutexA lstrcpynA lstrlenA ProcessIdToSessionId GetTickCount WideCharToMultiByte GetSystemTime GlobalUnlock GlobalLock GlobalSize GetTempPathW CreateSemaphoreW CreateDirectoryW lstrcatW lstrcpyW FindResourceExW ReleaseSemaphore Sleep UnmapViewOfFile MapViewOfFile GetTimeZoneInformation SetFilePointer GlobalAlloc GlobalFree GlobalReAlloc CreateFileA CreateFileMappingW OpenFileMappingW SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA LoadLibraryA GetStringTypeW GetStringTypeA FlushFileBuffers GetConsoleMode GetConsoleCP QueryPerformanceCounter FindResourceW LoadResource LockResource SizeofResource DeleteCriticalSection InitializeCriticalSection OpenThread SetLastError GetProcessHeap HeapAlloc HeapFree GetModuleHandleW GetProcAddress LocalFree RaiseException CreateToolhelp32Snapshot Thread32First Thread32Next GetLastError VirtualFree IsBadCodePtr VirtualAlloc VirtualProtect IsBadReadPtr InterlockedExchangeAdd WaitForSingleObject GetCurrentProcess DuplicateHandle InterlockedExchange CloseHandle GetCurrentThreadId TerminateThread GetCurrentThread GetThreadPriority SetThreadPriority FreeLibraryAndExitThread GetModuleFileNameW LoadLibraryW GetComputerNameW lstrlenW GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA GetFileType SetHandleCount GetModuleFileNameA GetStdHandle HeapCreate IsValidCodePage GetOEMCP TlsFree TlsSetValue TlsAlloc TlsGetValue ExitProcess GetModuleHandleA GetCPInfo LCMapStringW LCMapStringA GetCommandLineA IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess RtlUnwind GetThreadLocale GetLocaleInfoA GetACP HeapSize HeapReAlloc HeapDestroy GetVersionExA

user32

SendMessageTimeoutW FindWindowExW UnregisterClassA PostThreadMessageW PeekMessageW DispatchMessageW KillTimer GetWindowTextW SetTimer MsgWaitForMultipleObjects CharNextW GetClassNameW RegisterWindowMessageW CharLowerW CharLowerBuffW GetDesktopWindow

advapi32

CryptReleaseContext CryptDeriveKey CryptDecrypt CryptEncrypt CryptDestroyKey ConvertStringSidToSidW SetNamedSecurityInfoW ImpersonateLoggedOnUser OpenThreadToken RevertToSelf OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges ConvertStringSecurityDescriptorToSecurityDescriptorW GetSecurityDescriptorSacl SetSecurityDescriptorSacl InitializeSecurityDescriptor SetSecurityDescriptorDacl CryptAcquireContextW CryptCreateHash CryptHashData CryptGetHashParam CryptDestroyHash RegEnumKeyExW RegQueryInfoKeyW RegSetValueExW RegCreateKeyExW RegDeleteValueW RegDeleteKeyW RegGetKeySecurity RegOpenKeyW RegSetKeySecurity RegQueryValueExW RegOpenKeyExW RegCloseKey LookupAccountNameW ConvertSidToStringSidW

ole32

CoInitializeEx CoUninitialize CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree StringFromCLSID GetHGlobalFromStream CreateStreamOnHGlobal CoCreateInstance

oleaut32

SysStringLen SysFreeString SysAllocString VarUI4FromStr VariantInit VariantClear VariantChangeType SysAllocStringLen SystemTimeToVariantTime SysAllocStringByteLen SafeArrayUnaccessData SafeArrayAccessData VarBstrCmp SafeArrayDestroy SafeArrayPutElement SafeArrayGetElement SysStringByteLen SafeArrayCreate

shlwapi

PathFileExistsW SHCreateStreamOnFileW PathStripPathW StrStrIW

wtsapi32

WTSFreeMemory WTSQuerySessionInformationW WTSOpenServerW WTSCloseServer

netapi32

NetWkstaUserEnum NetApiBufferFree

oleacc

ObjectFromLresult

Name

.text

Size

124KB

Virtual Size

121KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

36KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.SHARSTA

Size

4KB

Virtual Size

52B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

28KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

20KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_Trojan.Win32.Skillis.iot.9c65683389b8a3836b3e27fb8396eb72

kernel32

user32

advapi32

ole32

oleaut32

shlwapi

wtsapi32

netapi32

oleacc

generic