jaffacakes118_Trojan-Downloader[.]Win32[.]Upatre[.]fyug[.]7bd67403cc46251d406394b611e43b98

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan-Downloader.Win32.Upatre.fyug.7bd67403cc46251d406394b611e43b98
Size 184KB
Sample261019-bglgkade96
SHA256 520e78f7c5f55de70c15031db0c2aad2a3708fcceb5198c24628d497093c4ae0
MD5 7bd67403cc46251d406394b611e43b98
SHA1 c84f306aa5b8dde78ca56f45271410f09eb05396
SHA512 88e26cfb2fd1ac89b54de3efdf2183c585c1442ec82022380d9a39d9afa16be1ba5a30c971b7899d01afff552c84a830c886b8793dfc1c684d33dd1533822518
SSDEEP 3072:ILdX0tK/I4vUF9KSPvTHFECy0eAQ5eQOMaqhpVpdxkS:kvUF97nTiDAQ5CMXhXJ
TLSH
T13A04CF12A3F5C435F0F75B7418B983951A3BBD92AE39C10F6B04168E4E72AD4DA39723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan-Downloader.Win32.Upatre.fyug.7bd67403cc46251d406394b611e43b98

File Explorer

jaffacakes118_Trojan-Downloader.Win32.Upatre.fyug.7bd67403cc46251d406394b611e43b98

.exe 184KB

jaffacakes118_Trojan-Downloader.Win32.Upatre.fyug.7bd67403cc46251d406394b611e43b98

IMPHASH cefc3d6cb3b31e68f614530fd9e41aec
SHA256 520e78f7c5f55de70c15031db0c2aad2a3708fcceb5198c24628d497093c4ae0
MD5 7bd67403cc46251d406394b611e43b98
SHA1 c84f306aa5b8dde78ca56f45271410f09eb05396
SHA512 88e26cfb2fd1ac89b54de3efdf2183c585c1442ec82022380d9a39d9afa16be1ba5a30c971b7899d01afff552c84a830c886b8793dfc1c684d33dd1533822518
SSDEEP 3072:ILdX0tK/I4vUF9KSPvTHFECy0eAQ5eQOMaqhpVpdxkS:kvUF97nTiDAQ5CMXhXJ
TLSH
T13A04CF12A3F5C435F0F75B7418B983951A3BBD92AE39C10F6B04168E4E72AD4DA39723
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

9407

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA CloseHandle LocalFree LCMapStringW LCMapStringA GetLocaleInfoA MultiByteToWideChar HeapSize SetFilePointer FlushFileBuffers GetConsoleMode GetConsoleCP CreateFileA GetLastError GetStringTypeW LocalAlloc GetOEMCP GetACP GetModuleHandleA SetLastError GetProcAddress GetStringTypeA LoadLibraryW GetCPInfo LoadLibraryA RtlUnwind InitializeCriticalSection GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter InterlockedDecrement GetCurrentThreadId InterlockedIncrement HeapAlloc EnterCriticalSection LeaveCriticalSection GetCommandLineA HeapFree GetVersionExA GetProcessHeap GetStartupInfoA DeleteCriticalSection VirtualFree VirtualAlloc HeapReAlloc HeapDestroy HeapCreate ExitProcess WriteFile GetStdHandle GetModuleFileNameA SetHandleCount GetFileType TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent Sleep FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW TlsGetValue TlsAlloc TlsSetValue TlsFree

user32

GetDC DestroyWindow GetClientRect MapWindowPoints GetParent EndPaint BeginPaint ScrollWindow BroadcastSystemMessageA GetDlgItem CreatePopupMenu AppendMenuA GetScrollInfo GetCursorPos TrackPopupMenu SendMessageA DefWindowProcA SetForegroundWindow GetSysColor SetCapture ReleaseDC CreateWindowExA CheckDlgButton IsDlgButtonChecked MessageBoxA SetScrollInfo

gdi32

GetStockObject GetTextMetricsA TextOutA CreateFontA DeleteObject SetBkColor

comdlg32

GetSaveFileNameW

advapi32

InitializeSecurityDescriptor SetSecurityDescriptorDacl FreeSid AllocateAndInitializeSid

shell32

Shell_NotifyIconA

ws2_32

getsockname getsockopt WSAStartup htonl

version

GetFileVersionInfoSizeA

secur32

QueryCredentialsAttributesA AcquireCredentialsHandleA EnumerateSecurityPackagesA

tapi32

phoneGetLamp