jaffacakes118_Trojan[.]Win32[.]Hooker[.]fa[.]0586b305849eb4f999370a19cd84b1f0

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan.Win32.Hooker.fa.0586b305849eb4f999370a19cd84b1f0
Size 829KB
Sample261018-wh5xtaca59
SHA256 fa91b2a024b3ba8f276745d8a1d944a55f2383f4a20e65117120c071315ce631
MD5 0586b305849eb4f999370a19cd84b1f0
SHA1 8371c7d4824f80ff7a673952bd1ec4acb7c5b8a0
SHA512 38fe1920e484d8dd14c15bd740013a53047d3cab12fedaa9473ba7a59821cbd96ab9ab754c023c78555119f78354471ca881e4f3e1bcf21e46d595c58ddfca85
SSDEEP 6144:MQxcSCFyfvIIsgAxk7bDp5DHRYleaR5l1z3nf2GY49ucCEM7zGdn1FMsm5npvD:MQKyfvBDvjKeaR5Dr2P4ccCECzGV16dD
TLSH
T1B4055A017750C076D75A17358446EB716AB9AD312BA2C6CBF7A47E3A5E302C29E3730E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan.Win32.Hooker.fa.0586b305849eb4f999370a19cd84b1f0

File Explorer

jaffacakes118_Trojan.Win32.Hooker.fa.0586b305849eb4f999370a19cd84b1f0

.exe 829KB

jaffacakes118_Trojan.Win32.Hooker.fa.0586b305849eb4f999370a19cd84b1f0

IMPHASH 50d816f0e457a26e26b1313e082ad034
SHA256 fa91b2a024b3ba8f276745d8a1d944a55f2383f4a20e65117120c071315ce631
MD5 0586b305849eb4f999370a19cd84b1f0
SHA1 8371c7d4824f80ff7a673952bd1ec4acb7c5b8a0
SHA512 38fe1920e484d8dd14c15bd740013a53047d3cab12fedaa9473ba7a59821cbd96ab9ab754c023c78555119f78354471ca881e4f3e1bcf21e46d595c58ddfca85
SSDEEP 6144:MQxcSCFyfvIIsgAxk7bDp5DHRYleaR5l1z3nf2GY49ucCEM7zGdn1FMsm5npvD:MQKyfvBDvjKeaR5Dr2P4ccCECzGV16dD
TLSH
T1B4055A017750C076D75A17358446EB716AB9AD312BA2C6CBF7A47E3A5E302C29E3730E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

128833

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

e:\code_public\ntframe\multiIEcode\multi\Release\multi.pdb

kernel32

InterlockedExchangeAdd InterlockedDecrement InterlockedIncrement IsBadWritePtr GetModuleHandleW DeviceIoControl GetVersionExA LockResource LoadResource SizeofResource FindResourceA MultiByteToWideChar GetFileSize SetFileAttributesA GetFileAttributesA lstrcmpiA GetCurrentProcessId ExitProcess WritePrivateProfileStringA SetUnhandledExceptionFilter CopyFileA ResumeThread FindClose FindNextFileA FindFirstFileA SetProcessWorkingSetSize HeapFree FreeLibrary GetWindowsDirectoryA GetProcessHeap HeapAlloc VirtualFreeEx Module32Next ReadProcessMemory GetVersion GetCommandLineA GetExitCodeThread WaitForSingleObject CreateRemoteThread IsBadReadPtr DeleteFileA TerminateProcess CreateProcessA Module32First CreateFileA GetModuleFileNameA GetCurrentThreadId lstrlenW SetThreadPriority GetThreadPriority GetCurrentThread GetCurrentProcess FlushInstructionCache WideCharToMultiByte GetModuleHandleA FormatMessageA OutputDebugStringA GlobalAlloc GlobalFree LocalFree Sleep GetTickCount CreateThread CloseHandle OpenProcess Thread32Next Thread32First Process32Next Process32First CreateToolhelp32Snapshot GetLastError GetProcAddress LoadLibraryA WriteProcessMemory VirtualAllocEx lstrcpyA lstrcatA RtlMoveMemory UnmapViewOfFile lstrcmpW SetLastError CompareStringA GlobalDeleteAtom GlobalFindAtomA GlobalAddAtomA GlobalGetAtomNameA lstrlenA GlobalUnlock GlobalLock LocalAlloc LeaveCriticalSection TlsGetValue EnterCriticalSection GlobalReAlloc GlobalHandle InitializeCriticalSection TlsAlloc TlsSetValue LocalReAlloc DeleteCriticalSection TlsFree lstrcmpA GlobalFlags GetLocaleInfoA GetCPInfo GetOEMCP ReadFile WriteFile SetFilePointer FlushFileBuffers SetEndOfFile UnhandledExceptionFilter IsDebuggerPresent GetSystemTimeAsFileTime GetStartupInfoA RtlUnwind RaiseException VirtualAlloc HeapReAlloc HeapSize SetHandleCount GetStdHandle GetFileType GetACP IsValidCodePage VirtualFree HeapCreate GetConsoleCP GetConsoleMode FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter InitializeCriticalSectionAndSpinCount SetStdHandle LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW WriteConsoleA GetConsoleOutputCP WriteConsoleW MapViewOfFile CreateFileMappingA GetSystemDirectoryA

user32

IsWindowEnabled CheckMenuItem EnableMenuItem GetMenuState ModifyMenuA LoadBitmapA GetMenuCheckMarkDimensions SetMenuItemBitmaps TabbedTextOutA DrawTextA DrawTextExA GrayStringA ClientToScreen GetDC ReleaseDC DestroyMenu ValidateRect GetSysColorBrush GetWindow GetWindowPlacement IsIconic SystemParametersInfoA GetLastActivePopup GetForegroundWindow RegisterWindowMessageA LoadIconA WinHelpA GetCapture SetWindowsHookExA GetDlgItem GetTopWindow DestroyWindow UnhookWindowsHookEx GetMessageTime GetKeyState GetMenu CallWindowProcA GetDlgCtrlID CopyRect CallNextHookEx GetClassLongA SetPropA GetPropA GetClientRect SetWindowTextA RegisterHotKey PostQuitMessage EnableWindow PostThreadMessageA UpdateWindow CreateWindowExA DefWindowProcA GetSubMenu TrackPopupMenu PostMessageA EndPaint BeginPaint EndMenu IsWindowVisible GetSystemMetrics WindowFromPoint GetCursorPos LoadMenuA SetTimer GetWindowLongA SetWindowLongA GetWindowTextA ScreenToClient DispatchMessageA TranslateMessage PeekMessageA PtInRect RegisterClassExA LoadCursorA SendMessageW SendMessageA FindWindowA ShowWindow FindWindowExA SetWindowPos AdjustWindowRectEx GetWindowRect IsWindow GetParent EnumChildWindows GetClassNameA GetWindowThreadProcessId EnumWindows RemovePropA GetFocus GetWindowTextLengthA GetMessagePos GetSysColor RegisterClassA GetClassInfoA GetClassInfoExA MessageBoxA GetMenuItemCount GetMenuItemID SetForegroundWindow SetMenu MapWindowPoints

gdi32

PtVisible RectVisible TextOutA ExtTextOutA Escape SelectObject SetViewportOrgEx DeleteObject SetMapMode CreateFontIndirectA GetObjectA DeleteDC GetDeviceCaps CreateDCA OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowExtEx ScaleWindowExtEx RestoreDC SaveDC CreateBitmap SetBkColor SetTextColor GetClipBox GetStockObject

advapi32

RegSetValueExA SetSecurityDescriptorDacl InitializeSecurityDescriptor RegOpenKeyExA RegDeleteValueA RegCloseKey GetNamedSecurityInfoA BuildExplicitAccessWithNameA SetEntriesInAclA SetNamedSecurityInfoA OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegQueryValueExA RegEnumKeyExA RegDeleteKeyA RegQueryValueA OpenSCManagerA CreateServiceA OpenServiceA StartServiceA CloseServiceHandle RegEnumKeyA RegCreateKeyExA

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHGetSpecialFolderPathA

ole32

OleInitialize CoCreateInstance OleUninitialize CoInitialize CoUninitialize StgCreateDocfile OleCreate

oleaut32

VariantChangeType VariantInit SysAllocString SysFreeString VariantClear SafeArrayCreate SafeArrayAccessData SafeArrayDestroy

shlwapi

StrStrW StrStrIA StrStrIW

psapi

GetModuleFileNameExA GetProcessImageFileNameA GetModuleInformation

version

VerQueryValueA GetFileVersionInfoSizeA GetFileVersionInfoA

dbghelp

MiniDumpWriteDump

wininet

FindNextUrlCacheEntryA DeleteUrlCacheEntry FindFirstUrlCacheEntryA

oleacc

LresultFromObject CreateStdAccessibleObject

winspool.drv

ClosePrinter DocumentPropertiesA OpenPrinterA