jaffacakes118_Trojan[.]Win32[.]Inject[.]vegq[.]4185a1687623e3d7b5b235b0b2d66454

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan.Win32.Inject.vegq.4185a1687623e3d7b5b235b0b2d66454
Size 539KB
Sample261018-vr8jmasth1
SHA256 e195d120820e6838e29cb1061593eaa397aea309155658332eb12daf1697a26b
MD5 4185a1687623e3d7b5b235b0b2d66454
SHA1 8b8778647219148fd4a04004925ed8d65e8c4bcc
SHA512 f4c0edf8b51b6098f7a466b10c0985faab58cd26eab849860a76708860e1622f8fc59f4251f3335952c08d1e4cb4e6b1e2f3cb91b1c94f23eb67a68187d78527
SSDEEP 12288:Z0D8koTs1N+bR4eH1xTGZGkWhpGFwzcxHU3N9/vB4/:htIcyerTGYbMFwhNf4
TLSH
T11BC4F152ABA49CF0D4B2767199B3CA768F3BBD376534400B26D53E230E70AA32476753
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan.Win32.Inject.vegq.4185a1687623e3d7b5b235b0b2d66454

File Explorer

jaffacakes118_Trojan.Win32.Inject.vegq.4185a1687623e3d7b5b235b0b2d66454

.exe 539KB

jaffacakes118_Trojan.Win32.Inject.vegq.4185a1687623e3d7b5b235b0b2d66454

IMPHASH 71ce43f3108f289306bbcafe4d43fde0
SHA256 e195d120820e6838e29cb1061593eaa397aea309155658332eb12daf1697a26b
MD5 4185a1687623e3d7b5b235b0b2d66454
SHA1 8b8778647219148fd4a04004925ed8d65e8c4bcc
SHA512 f4c0edf8b51b6098f7a466b10c0985faab58cd26eab849860a76708860e1622f8fc59f4251f3335952c08d1e4cb4e6b1e2f3cb91b1c94f23eb67a68187d78527
SSDEEP 12288:Z0D8koTs1N+bR4eH1xTGZGkWhpGFwzcxHU3N9/vB4/:htIcyerTGYbMFwhNf4
TLSH
T11BC4F152ABA49CF0D4B2767199B3CA768F3BBD376534400B26D53E230E70AA32476753
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

18958

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_WDM_DRIVER IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

W:\Previews\informing\touch\levera.pdb

kernel32

FlushFileBuffers CreateFileW HeapReAlloc HeapSize GetStringTypeW LCMapStringW RtlUnwind MultiByteToWideChar WriteConsoleW SetFilePointer GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameA LoadLibraryW DeleteCriticalSection SetLastError TlsFree TlsSetValue TlsAlloc IsValidCodePage GetOEMCP GetACP InterlockedDecrement InterlockedIncrement GetCPInfo GetModuleFileNameW IsProcessorFeaturePresent GetConsoleMode GetConsoleCP WideCharToMultiByte GetFileType LeaveCriticalSection InitializeCriticalSectionAndSpinCount EnterCriticalSection SetStdHandle GetCurrentProcess TerminateProcess EncodePointer IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter RaiseException GetStartupInfoW HeapSetInformation GetCommandLineA DecodePointer ExitProcess GetModuleHandleW Sleep LocalFree GetVersion CloseHandle GetCurrentThreadId FillConsoleOutputAttribute GetModuleHandleA GetSystemInfo LocalAlloc GetConsoleScreenBufferInfo LoadLibraryA GetProcAddress GetLastError GetStdHandle GlobalUnlock ReadFile HeapCreate SetConsoleCursorPosition WriteFile GlobalLock GetProcessHeap HeapFree HeapAlloc lstrlenA FillConsoleOutputCharacterA GetFileSize CreateFileA TlsGetValue

user32

DialogBoxParamA GetDlgItemTextA LoadCursorA EnableWindow UpdateWindow SetWindowTextA GetSystemMetrics SystemParametersInfoA OpenClipboard DispatchMessageA SetThreadDesktop DrawFrameControl GetSysColorBrush CreatePopupMenu ShowWindow CheckDlgButton SetWindowPos DefWindowProcA EndDialog ChangeClipboardChain CreateWindowExA GetClipboardData UnregisterClassA InvalidateRect MessageBoxA SetDlgItemTextA GetDialogBaseUnits ValidateRect CopyRect IsDlgButtonChecked RegisterClassExA SetWindowLongA GetWindowTextA OffsetRect TranslateMessage BeginPaint SendMessageA EndPaint ClientToScreen DestroyWindow GetMessageA GetUserObjectInformationA EnumDisplayMonitors CloseClipboard SetProcessWindowStation GetWindowTextLengthA InsertMenuItemA GetWindowRect PostQuitMessage SendDlgItemMessageA GetWindowDC GetThreadDesktop DrawTextA CloseWindowStation GetFocus LoadBitmapA IsClipboardFormatAvailable ChildWindowFromPointEx CreateDesktopA LoadIconA GetProcessWindowStation GetClientRect SetFocus CloseDesktop

gdi32

SetTextColor DeleteDC CreateFontA CreateFontIndirectA SetBkColor ExcludeClipRect SetBkMode DeleteObject SelectObject CreateCompatibleDC CombineRgn CreateCompatibleBitmap CreateRectRgn GetObjectA GetStockObject TextOutA BitBlt

winspool.drv

ClosePrinter OpenPrinterA DeviceCapabilitiesA

advapi32

GetLengthSid CopySid GetTokenInformation DuplicateTokenEx

oleaut32

SysFreeString SysAllocString

ws2_32

WSACleanup gethostname closesocket accept WSAAsyncSelect

avicap32

capCreateCaptureWindowA

comctl32

PropertySheetA CreateToolbarEx CreatePropertySheetPageA

pdh

PdhCollectQueryData PdhAddCounterA PdhGetFormattedCounterValue PdhAddCounterW PdhOpenQueryA PdhCloseQuery

setupapi

SetupDiGetClassInstallParamsA SetupDiGetDeviceInstallParamsA SetupDiSetClassInstallParamsA SetupDiSetDeviceRegistryPropertyA SetupDiSetDeviceInstallParamsA

wtsapi32

WTSFreeMemory WTSQuerySessionInformationW WTSEnumerateProcessesA

uxtheme

DrawThemeBackground

Name

.text

Size

68KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

135KB

Virtual Size

134KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

123KB

Virtual Size

130KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.relob

Size

62KB

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.adata

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

112KB

Virtual Size

111KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_Trojan.Win32.Inject.vegq.4185a1687623e3d7b5b235b0b2d66454

kernel32

user32

gdi32

winspool.drv

advapi32

oleaut32

ws2_32

avicap32

comctl32

pdh

setupapi

wtsapi32

uxtheme

generic