General

  • Target
    jaffacakes118_Trojan.Win32.Hotkeychick.d.aff493ed1f98ed05c360b462192d2853
  • Size 4.4MB
  • Sample261018-wkvvmaca65
  • SHA256 69c0164bd5a3f28737152241ee1a7750c37ab6e80c4c456f6a34237da73c2f71
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10

Malware Config

Signatures

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • One or more HTTP URLs in PDF identified

    Detects presence of HTTP links in PDF files.

  • Unsigned PE 17 IoCs

    Checks for missing Authenticode signature.

  • Untrusted Codesign Signers 2 IoCs

    Codesigned file was signed by an untrusted entity.

  • NSIS installer 4 IoCs

File Explorer

  • jaffacakes118_Trojan.Win32.Hotkeychick.d.aff493ed1f98ed05c360b462192d2853
    .exe 4.4MB
  • $PLUGINSDIR/System.dll
    .dll 11KB
  • CHANGELOG.txt
    2KB
  • COPYING/COPYING.pdf
    .pdf 10KB
  • COPYING/COPYING.rtf
    686B
  • COPYING/deleteme.txt
    4B
  • LICENSE.txt
    1KB
  • Microsoft.VC80.CRT.manifest
    1KB
  • TODOS.txt
    236B
  • VERSION.txt
    4B
  • clamd.exe
    .exe 116KB
  • clamdscan.exe
    .exe 76KB
  • conf/freshclam.conf
    8KB
  • conf/options.ini
    1KB
  • conf/sniperscan.conf
    18KB
  • conf/sniperscanengine.conf
    18KB
  • database/deleteme.txt
    4B
  • database/mirrors.dat
    936B
  • freshclam.exe
    .exe 128KB
  • ico/ressource.dll
    .exe 403KB
  • ico/sniper.ico
    9KB
  • ico/sniperscan.ico
    85KB
  • libclamav.dll
    .dll 3.2MB
  • libclamunrar.dll
    .dll 64KB
  • libclamunrar_iface.dll
    .dll 25KB
  • libeay32.dll
    .dll 1.1MB
  • msvcm80.dll
    .dll 468KB
  • msvcp80.dll
    .dll 541KB
  • msvcr80.dll
    .dll 617KB
  • quarantine/deleteme.txt
    4B
  • question.png
    .png 382B
  • snipedscan.exe
    .exe 76KB
  • sniperscan.exe
    .exe 1.2MB
  • sniperscan.reg
    125B
  • sniperscanengine.exe
    .exe 213KB
  • sniperscanregistrationen.exe
    .exe 214KB
  • temp/deleteme.txt
    4B
  • uninstall.exe
    .exe 36KB
  • update/deleteme.txt
    4B
  • updater_en.exe
    .exe 907KB
  • version/VERSION.txt
    4B

jaffacakes118_Trojan.Win32.Hotkeychick.d.aff493ed1f98ed05c360b462192d2853

  • IMPHASH e160ef8e55bb9d162da4e266afd9eef3
  • SHA256 69c0164bd5a3f28737152241ee1a7750c37ab6e80c4c456f6a34237da73c2f71
  • MD5 SHA1 SHA512 SSDEEP TLSH
  • Unsigned PE

    Checks for missing Authenticode signature.

  • NSIS installer

Minor OS version
0
Major OS version
4
Entry point
12516
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE
PDB paths