jaffacakes118_Trojan[.]Win32[.]Inject[.]ahwau[.]27d254795a51a1977d22a81f943e94a6

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan.Win32.Inject.ahwau.27d254795a51a1977d22a81f943e94a6
Size 7.9MB
Sample261018-wtaaaafw9q
SHA256 5918150353c5b0be5357250c81aae2a8ada0ea8c4a05f20f9f58cfd301fb8117
MD5 27d254795a51a1977d22a81f943e94a6
SHA1 59a89ce22dafb4c5f7a18ff65bfd092657a58d18
SHA512 192275084e4426db917cf9e0251636125ce68b4776ccf61fb7c67c2a2de9fc46287b49c6192ba84186a20d0391ca456620bc132ce6e3c95e798333106b2423c5
SSDEEP 98304:yHcZwh+UmlSlfHZ74PnPRpvMVte8nffCuCiu+XXmDCp3lr+Ip2jm:0h7mQlfHZQPRpvMFiuC6cCH/V
TLSH
T15D86E03650CAE53FC49B073A04A7A1118F3E6F581117DC5799F98EAC8E7A54031BA78F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan.Win32.Inject.ahwau.27d254795a51a1977d22a81f943e94a6

File Explorer

jaffacakes118_Trojan.Win32.Inject.ahwau.27d254795a51a1977d22a81f943e94a6

.exe 7.9MB

jaffacakes118_Trojan.Win32.Inject.ahwau.27d254795a51a1977d22a81f943e94a6

IMPHASH 125ebd56ce9ab921f63684421de75c92
SHA256 5918150353c5b0be5357250c81aae2a8ada0ea8c4a05f20f9f58cfd301fb8117
MD5 27d254795a51a1977d22a81f943e94a6
SHA1 59a89ce22dafb4c5f7a18ff65bfd092657a58d18
SHA512 192275084e4426db917cf9e0251636125ce68b4776ccf61fb7c67c2a2de9fc46287b49c6192ba84186a20d0391ca456620bc132ce6e3c95e798333106b2423c5
SSDEEP 98304:yHcZwh+UmlSlfHZ74PnPRpvMVte8nffCuCiu+XXmDCp3lr+Ip2jm:0h7mQlfHZQPRpvMFiuC6cCH/V
TLSH
T15D86E03650CAE53FC49B073A04A7A1118F3E6F581117DC5799F98EAC8E7A54031BA78F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3049232

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

oleaut32

SysFreeString SysReAllocStringLen SysAllocStringLen SafeArrayPtrOfIndex SafeArrayPutElement SafeArrayGetElement SafeArrayUnaccessData SafeArrayAccessData SafeArrayGetUBound SafeArrayGetLBound SafeArrayCreate VariantChangeType VariantCopyInd VariantCopy VariantClear VariantInit CreateErrorInfo GetErrorInfo SetErrorInfo SysFreeString

advapi32

RegQueryValueExW RegOpenKeyExW RegCloseKey RegisterEventSourceW RegEnumKeyW ObjectOpenAuditAlarmA LookupPrivilegeValueA LookupPrivilegeValueW LookupPrivilegeNameW GetUserNameA GetUserNameW GetTokenInformation GetSidSubAuthorityCount GetSidSubAuthority GetSidIdentifierAuthority GetSecurityDescriptorSacl GetSecurityDescriptorOwner GetSecurityDescriptorLength GetSecurityDescriptorGroup GetSecurityDescriptorDacl GetSecurityDescriptorControl GetOldestEventLogRecord GetNumberOfEventLogRecords GetLengthSid GetKernelObjectSecurity GetFileSecurityA GetFileSecurityW GetCurrentHwProfileA GetCurrentHwProfileW GetAclInformation GetAce FindFirstFreeAce EqualSid DuplicateTokenEx DuplicateToken DestroyPrivateObjectSecurity ClearEventLogW

user32

CharNextW LoadStringW TranslateMessage PeekMessageW MsgWaitForMultipleObjects MessageBoxW LoadStringW GetWindowDC GetSystemMetrics GetDesktopWindow GetActiveWindow DispatchMessageW CharUpperBuffW CharUpperW CharLowerBuffW

kernel32

Sleep VirtualFree VirtualAlloc lstrlenW VirtualQuery GetTickCount GetSystemInfo GetVersion CompareStringW IsValidLocale SetThreadLocale GetSystemDefaultUILanguage GetUserDefaultUILanguage GetLocaleInfoW WideCharToMultiByte MultiByteToWideChar GetACP LoadLibraryExW GetStartupInfoW GetProcAddress GetModuleHandleW GetModuleFileNameW GetCommandLineW FreeLibrary GetLastError UnhandledExceptionFilter RtlUnwind RaiseException ExitProcess ExitThread SwitchToThread GetCurrentThreadId CreateThread DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection FindFirstFileW FindClose WriteFile GetStdHandle CloseHandle GetProcAddress RaiseException LoadLibraryA GetLastError TlsSetValue TlsGetValue LocalFree LocalAlloc GetModuleHandleW FreeLibrary WriteFile WideCharToMultiByte WaitForSingleObject VirtualQueryEx VirtualQuery VirtualProtect VirtualFree VerSetConditionMask VerifyVersionInfoW TryEnterCriticalSection SwitchToThread SuspendThread Sleep SetThreadPriority SetLastError SetFilePointer SetEvent SetEndOfFile ResumeThread ResetEvent RemoveDirectoryW ReadFile RaiseException QueryPerformanceFrequency QueryPerformanceCounter IsDebuggerPresent LocalFree LoadLibraryA LoadLibraryW LeaveCriticalSection IsValidLocale InitializeCriticalSection HeapSize HeapFree HeapDestroy HeapCreate HeapAlloc GetVersionExW GetTimeZoneInformation GetTickCount GetThreadPriority GetThreadLocale GetStdHandle GetProcAddress GetModuleHandleW GetModuleFileNameW GetLocaleInfoW GetLocalTime GetLastError GetFullPathNameW GetFileAttributesW GetExitCodeThread GetDiskFreeSpaceW GetDateFormatW GetCurrentThreadId GetCurrentThread GetCurrentProcess GetCPInfoExW GetCPInfo GetACP FreeLibrary FormatMessageW FindFirstFileW FindClose EnumSystemLocalesW EnumCalendarInfoW EnterCriticalSection DeleteFileW DeleteCriticalSection CreateFileW CreateEventW CompareStringW CloseHandle Sleep

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

netapi32

NetWkstaGetInfo

ole32

CoCreateInstance CoUninitialize CoInitialize

Name

.text

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

986KB

Virtual Size

986KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

4.3MB

Virtual Size

4.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

22KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didata

Size

1024B

Virtual Size

808B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

154B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

Virtual Size

28B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

93B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

192KB

Virtual Size

191KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

509KB

Virtual Size

509KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_Trojan.Win32.Inject.ahwau.27d254795a51a1977d22a81f943e94a6

oleaut32

advapi32

user32

kernel32

version

netapi32

ole32

generic