jaffacakes118_Trojan[.]Win32[.]Inject[.]ahwba[.]1b3576dbff637e1ce7c746b70da1e79e

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan.Win32.Inject.ahwba.1b3576dbff637e1ce7c746b70da1e79e
Size 7.9MB
Sample261018-wtcemsfx2k
SHA256 908db5ff1e431ac3235f9e683c07a457f1bbc8281d44de7a240a5d8b1623bf2f
MD5 1b3576dbff637e1ce7c746b70da1e79e
SHA1 fa736f34e8d383fa4b4f9a47090e77576daf6613
SHA512 e0e6882110f1279f2f491e7f8520905668fb2d10fa93b3e5e9bdca7d88d335ca0798b77cb0a078830ee9a74048740af5d57590f25437dd214d8bd9a7355bd8ac
SSDEEP 98304:WHcZwh+ULzxHoLEhbFoO+E4d+bxqzAYmzMCSEo8:Ih7LzxHoLE1FiEXgAYSMCPd
TLSH
T1ED86E16651CAE63EC457073A04A3A1118F3E6F581517DC57A9F98EACCF3A48031BA7CE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan.Win32.Inject.ahwba.1b3576dbff637e1ce7c746b70da1e79e

File Explorer

jaffacakes118_Trojan.Win32.Inject.ahwba.1b3576dbff637e1ce7c746b70da1e79e

.exe 7.9MB

jaffacakes118_Trojan.Win32.Inject.ahwba.1b3576dbff637e1ce7c746b70da1e79e

IMPHASH 125ebd56ce9ab921f63684421de75c92
SHA256 908db5ff1e431ac3235f9e683c07a457f1bbc8281d44de7a240a5d8b1623bf2f
MD5 1b3576dbff637e1ce7c746b70da1e79e
SHA1 fa736f34e8d383fa4b4f9a47090e77576daf6613
SHA512 e0e6882110f1279f2f491e7f8520905668fb2d10fa93b3e5e9bdca7d88d335ca0798b77cb0a078830ee9a74048740af5d57590f25437dd214d8bd9a7355bd8ac
SSDEEP 98304:WHcZwh+ULzxHoLEhbFoO+E4d+bxqzAYmzMCSEo8:Ih7LzxHoLE1FiEXgAYSMCPd
TLSH
T1ED86E16651CAE63EC457073A04A3A1118F3E6F581517DC57A9F98EACCF3A48031BA7CE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3049364

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

oleaut32

SysFreeString SysReAllocStringLen SysAllocStringLen SafeArrayPtrOfIndex SafeArrayPutElement SafeArrayGetElement SafeArrayUnaccessData SafeArrayAccessData SafeArrayGetUBound SafeArrayGetLBound SafeArrayCreate VariantChangeType VariantCopyInd VariantCopy VariantClear VariantInit CreateErrorInfo GetErrorInfo SetErrorInfo SysFreeString

advapi32

RegQueryValueExW RegOpenKeyExW RegCloseKey RegisterEventSourceW RegEnumKeyW ObjectOpenAuditAlarmA LookupPrivilegeValueA LookupPrivilegeValueW LookupPrivilegeNameW GetUserNameA GetUserNameW GetTokenInformation GetSidSubAuthorityCount GetSidSubAuthority GetSidIdentifierAuthority GetSecurityDescriptorSacl GetSecurityDescriptorOwner GetSecurityDescriptorLength GetSecurityDescriptorGroup GetSecurityDescriptorDacl GetSecurityDescriptorControl GetOldestEventLogRecord GetNumberOfEventLogRecords GetLengthSid GetKernelObjectSecurity GetFileSecurityA GetFileSecurityW GetCurrentHwProfileA GetCurrentHwProfileW GetAclInformation GetAce FindFirstFreeAce EqualSid DuplicateTokenEx DuplicateToken DestroyPrivateObjectSecurity ClearEventLogW

user32

CharNextW LoadStringW TranslateMessage PeekMessageW MsgWaitForMultipleObjects MessageBoxW LoadStringW GetWindowDC GetSystemMetrics GetDesktopWindow GetActiveWindow DispatchMessageW CharUpperBuffW CharUpperW CharLowerBuffW

kernel32

Sleep VirtualFree VirtualAlloc lstrlenW VirtualQuery GetTickCount GetSystemInfo GetVersion CompareStringW IsValidLocale SetThreadLocale GetSystemDefaultUILanguage GetUserDefaultUILanguage GetLocaleInfoW WideCharToMultiByte MultiByteToWideChar GetACP LoadLibraryExW GetStartupInfoW GetProcAddress GetModuleHandleW GetModuleFileNameW GetCommandLineW FreeLibrary GetLastError UnhandledExceptionFilter RtlUnwind RaiseException ExitProcess ExitThread SwitchToThread GetCurrentThreadId CreateThread DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection FindFirstFileW FindClose WriteFile GetStdHandle CloseHandle GetProcAddress RaiseException LoadLibraryA GetLastError TlsSetValue TlsGetValue LocalFree LocalAlloc GetModuleHandleW FreeLibrary WriteFile WideCharToMultiByte WaitForSingleObject VirtualQueryEx VirtualQuery VirtualProtect VirtualFree VerSetConditionMask VerifyVersionInfoW TryEnterCriticalSection SwitchToThread SuspendThread Sleep SetThreadPriority SetLastError SetFilePointer SetEvent SetEndOfFile ResumeThread ResetEvent RemoveDirectoryW ReadFile RaiseException QueryPerformanceFrequency QueryPerformanceCounter IsDebuggerPresent LocalFree LoadLibraryA LoadLibraryW LeaveCriticalSection IsValidLocale InitializeCriticalSection HeapSize HeapFree HeapDestroy HeapCreate HeapAlloc GetVersionExW GetTimeZoneInformation GetTickCount GetThreadPriority GetThreadLocale GetStdHandle GetProcAddress GetModuleHandleW GetModuleFileNameW GetLocaleInfoW GetLocalTime GetLastError GetFullPathNameW GetFileAttributesW GetExitCodeThread GetDiskFreeSpaceW GetDateFormatW GetCurrentThreadId GetCurrentThread GetCurrentProcess GetCPInfoExW GetCPInfo GetACP FreeLibrary FormatMessageW FindFirstFileW FindClose EnumSystemLocalesW EnumCalendarInfoW EnterCriticalSection DeleteFileW DeleteCriticalSection CreateFileW CreateEventW CompareStringW CloseHandle Sleep

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

netapi32

NetWkstaGetInfo

ole32

CoCreateInstance CoUninitialize CoInitialize

Name

.text

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

986KB

Virtual Size

986KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

4.3MB

Virtual Size

4.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

22KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didata

Size

1024B

Virtual Size

808B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

154B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

Virtual Size

28B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

93B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

192KB

Virtual Size

191KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

509KB

Virtual Size

509KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_Trojan.Win32.Inject.ahwba.1b3576dbff637e1ce7c746b70da1e79e

oleaut32

advapi32

user32

kernel32

version

netapi32

ole32

generic