jaffacakes118_Trojan[.]Win32[.]FakeAV[.]elmj[.]17bcbc9b6f5ffa6df4cf9b5d0f56770e

General

Target
jaffacakes118_Trojan.Win32.FakeAV.elmj.17bcbc9b6f5ffa6df4cf9b5d0f56770e
Size 144KB
Sample261018-x7l2nstycw
SHA256 f7cfb839160fbf213caaedee9c3c72831028a06ad83f67858322b5272ca3b51b
MD5 17bcbc9b6f5ffa6df4cf9b5d0f56770e
SHA1 3f979f6adafcc70665c91eb8673f8a805a0ae18a
SHA512 f789459b2b14536e43ba3c9c5eb6a2767ae4ed948063437fd73fa99794d75997b8af596f333b4324522ada9d9053c83e099f001a899b1b44aa17b00b0a7cb7c8
SSDEEP 3072:CH9SrByjZo5Fapg1g52QTsvde3RZrPuxyzmVPxXGer3xcECn:QStHIsvdORZDuoaMej+ES
TLSH
T1B7E3BF17B7A79E2BF451D57324D055538EEA5C2208F1479EB3402A23F8B49D0AEDBB03
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan.Win32.FakeAV.elmj.17bcbc9b6f5ffa6df4cf9b5d0f56770e

File Explorer

jaffacakes118_Trojan.Win32.FakeAV.elmj.17bcbc9b6f5ffa6df4cf9b5d0f56770e

.exe 144KB

jaffacakes118_Trojan.Win32.FakeAV.elmj.17bcbc9b6f5ffa6df4cf9b5d0f56770e

IMPHASH 9abc0669913460dac5f054984d7ccd45
SHA256 f7cfb839160fbf213caaedee9c3c72831028a06ad83f67858322b5272ca3b51b
MD5 17bcbc9b6f5ffa6df4cf9b5d0f56770e
SHA1 3f979f6adafcc70665c91eb8673f8a805a0ae18a
SHA512 f789459b2b14536e43ba3c9c5eb6a2767ae4ed948063437fd73fa99794d75997b8af596f333b4324522ada9d9053c83e099f001a899b1b44aa17b00b0a7cb7c8
SSDEEP 3072:CH9SrByjZo5Fapg1g52QTsvde3RZrPuxyzmVPxXGer3xcECn:QStHIsvdORZDuoaMej+ES
TLSH
T1B7E3BF17B7A79E2BF451D57324D055538EEA5C2208F1479EB3402A23F8B49D0AEDBB03
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

23378

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

ResumeThread SetComputerNameA GetLocalTime GlobalFree VirtualAlloc GetModuleHandleA GlobalAlloc LoadLibraryA VirtualFree lstrcpyA GetTickCount SuspendThread FreeResource SizeofResource LockResource LoadResource GetLastError VirtualProtect GetProcAddress VirtualQuery SetLastError GetStringTypeA LCMapStringW LCMapStringA MultiByteToWideChar HeapReAlloc HeapAlloc GetOEMCP GetACP GetCPInfo CreateThread LocalAlloc CreateFileA CloseHandle ReadFile CopyFileExA Sleep HeapCompact FindResourceExA GetStartupInfoA GetCommandLineA GetVersion ExitProcess TerminateProcess GetCurrentProcess UnhandledExceptionFilter GetModuleFileNameA FreeEnvironmentStringsA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStrings GetEnvironmentStringsW SetHandleCount GetStdHandle GetFileType HeapDestroy HeapCreate HeapFree RtlUnwind WriteFile GetStringTypeW

user32

IsWindow GetDC GetDesktopWindow LoadBitmapA wsprintfA LoadIconA ReleaseDC IsWindowVisible MessageBoxA

gdi32

CreatePenIndirect GetDeviceCaps SelectObject DeleteObject

advapi32

RegOpenKeyExA RegSetKeySecurity RegEnumKeyExA

Sharing