jaffacakes118_Virus[.]Win32[.]Sality[.]gen[.]4f0123c25b60b88fdb69a74d5f618ebf

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Virus.Win32.Sality.gen.4f0123c25b60b88fdb69a74d5f618ebf
Size 437KB
Sample261018-tbreqsf14s
SHA256 41c96c9c3cde8d204ee27ab4bc7b43a65b74300e36d7b7d812c6ef0eb6e73770
MD5 4f0123c25b60b88fdb69a74d5f618ebf
SHA1 c9905a89cd0994d3890f711cc8a5d7eefe432ada
SHA512 e07a42bb7920e2c7c9b709f4cc1d23bb2f459b70cffed84817ac696228ba058755e57958cb62f253e3c9d7b4dd0d95f32b8418720c976dcdb7549763ecddb3e4
SSDEEP 3072:zHbJlI4sEk2qcRdEjXzCa+jDEZ/5MGfj+SCeNRQ/pNaIgkXHRJdsgDAg16QX0uES:bbfyEkDfTCeNRQRIIfXR8gDAYEuVit6
TLSH
T1C494E58178348045E5D718B11D7AD46130FA2DECBA886D9EB4D9BB9E53B23D3106B3CE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Virus.Win32.Sality.gen.4f0123c25b60b88fdb69a74d5f618ebf

File Explorer

jaffacakes118_Virus.Win32.Sality.gen.4f0123c25b60b88fdb69a74d5f618ebf

.exe 437KB

jaffacakes118_Virus.Win32.Sality.gen.4f0123c25b60b88fdb69a74d5f618ebf

IMPHASH f05bcba3a23dbf71954b5a30f0311c79
SHA256 41c96c9c3cde8d204ee27ab4bc7b43a65b74300e36d7b7d812c6ef0eb6e73770
MD5 4f0123c25b60b88fdb69a74d5f618ebf
SHA1 c9905a89cd0994d3890f711cc8a5d7eefe432ada
SHA512 e07a42bb7920e2c7c9b709f4cc1d23bb2f459b70cffed84817ac696228ba058755e57958cb62f253e3c9d7b4dd0d95f32b8418720c976dcdb7549763ecddb3e4
SSDEEP 3072:zHbJlI4sEk2qcRdEjXzCa+jDEZ/5MGfj+SCeNRQ/pNaIgkXHRJdsgDAg16QX0uES:bbfyEkDfTCeNRQRIIfXR8gDAYEuVit6
TLSH
T1C494E58178348045E5D718B11D7AD46130FA2DECBA886D9EB4D9BB9E53B23D3106B3CE
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

31022

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

e:\src\converter\rel32\RealConverter.pdb

ole32

OleInitialize OleUninitialize

kernel32

FreeLibrary GetProcAddress LoadLibraryA GetVersionExA DeleteFileA CreateFileA GetModuleFileNameA VirtualQuery GetFileAttributesA CreateDirectoryA WideCharToMultiByte MoveFileA GetTickCount GetCurrentProcessId SetEnvironmentVariableA GetEnvironmentVariableA RaiseException InitializeCriticalSection DeleteCriticalSection SizeofResource LockResource LoadResource FindResourceA FindResourceExA CreateMutexA SetCurrentDirectoryA GetCurrentDirectoryA IsBadWritePtr VirtualProtect IsBadReadPtr GetModuleHandleA SetUnhandledExceptionFilter TerminateThread WaitForSingleObject CreateThread GetCurrentThreadId GetCurrentProcess WriteFile GetThreadContext OpenProcess SetFilePointer GlobalMemoryStatus HeapSize HeapReAlloc HeapFree HeapAlloc HeapDestroy LeaveCriticalSection EnterCriticalSection GetLastError CloseHandle ReleaseMutex GetSystemTimeAsFileTime ExitProcess GetStartupInfoA QueryPerformanceCounter SetErrorMode GetProcessHeap

user32

GetSystemMetrics GetDC ReleaseDC

advapi32

RegCloseKey RegOpenKeyA RegQueryValueExA RegOpenKeyExA

version

GetFileVersionInfoA VerQueryValueA

gdi32

GetDeviceCaps

msvcr71

??2@YAPAXI@Z tolower isupper strncpy strchr strtol strncat wcslen _vsnprintf __CxxFrameHandler getenv sprintf free _except_handler3 _CxxThrowException strrchr atoi memmove vsprintf asctime gmtime time ?terminate@@YAXXZ __dllonexit _onexit _c_exit _exit _XcptFilter _ismbblead _cexit exit _acmdln _amsg_exit __getmainargs _initterm __setusermatherr _adjust_fdiv __p__commode __p__fmode __set_app_type ??1type_info@@UAE@XZ _controlfp memset _putenv _stricmp _purecall _mbctype __security_error_handler ??3@YAXPAX@Z

shell32

SHGetFolderPathA

shlwapi

PathAddBackslashA PathAppendA