jaffacakes118_Trojan-Downloader[.]Win32[.]Upatre[.]gagx[.]46bd33f19fab3d16980d1727487e1677

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Trojan-Downloader.Win32.Upatre.gagx.46bd33f19fab3d16980d1727487e1677
Size 258KB
Sample261019-bgna6ade98
SHA256 1003184bbb900185271df36af1af976e8dadde7c994e33899c5d64c5d7723af2
MD5 46bd33f19fab3d16980d1727487e1677
SHA1 0a6f922d0771614178e57394ec3dfc095e2d1f14
SHA512 15e10928bd56ad3e4d8d85886540d5237fa6e31ebc3f9e11bdadd47a9d8013f60c514ba145e31cc767d246683c0208fa83ca010ec18452f37f698d35c484c68b
SSDEEP 6144:l4Y1MyFDm00EO1HwEPj67696+naxxY6JrzZb4zb:4yQ00V1QR76JWbltb4zb
TLSH
T10A448E11A48A8CB9CE410CF908B26773973CBE611B295273F7DA1B75BBD77C0185EA09
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan-Downloader.Win32.Upatre.gagx.46bd33f19fab3d16980d1727487e1677

File Explorer

jaffacakes118_Trojan-Downloader.Win32.Upatre.gagx.46bd33f19fab3d16980d1727487e1677

.exe 258KB

jaffacakes118_Trojan-Downloader.Win32.Upatre.gagx.46bd33f19fab3d16980d1727487e1677

IMPHASH f15c28eeaade8f6ed911e5f269d33949
SHA256 1003184bbb900185271df36af1af976e8dadde7c994e33899c5d64c5d7723af2
MD5 46bd33f19fab3d16980d1727487e1677
SHA1 0a6f922d0771614178e57394ec3dfc095e2d1f14
SHA512 15e10928bd56ad3e4d8d85886540d5237fa6e31ebc3f9e11bdadd47a9d8013f60c514ba145e31cc767d246683c0208fa83ca010ec18452f37f698d35c484c68b
SSDEEP 6144:l4Y1MyFDm00EO1HwEPj67696+naxxY6JrzZb4zb:4yQ00V1QR76JWbltb4zb
TLSH
T10A448E11A48A8CB9CE410CF908B26773973CBE611B295273F7DA1B75BBD77C0185EA09
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

64951

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\unprepared\Access\Listitem\Tran.pdb

kernel32

MultiByteToWideChar LCMapStringW HeapSize GetConsoleMode GetConsoleCP SetFilePointer CreateFileA GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter HeapCreate DeleteCriticalSection GetFileType SetHandleCount GetEnvironmentStringsW WideCharToMultiByte FreeEnvironmentStringsW GetStringTypeW EnumSystemCodePagesW GetStdHandle WriteFile ExitProcess VirtualQuery GetCurrentThreadId SetLastError GetModuleHandleW TlsFree TlsSetValue TlsGetValue TlsAlloc IsValidCodePage GetOEMCP GetACP InterlockedDecrement InterlockedIncrement GetCPInfo HeapFree GetCurrentProcess LoadLibraryW HeapReAlloc FlushFileBuffers SetStdHandle SetEndOfFile GetProcessHeap ReadFile IsProcessorFeaturePresent WriteConsoleW CreateFileW GetModuleFileNameA LocalReAlloc LocalAlloc _lwrite Sleep OutputDebugStringA HeapAlloc GetProcAddress GetModuleHandleA CloseHandle GetLastError _lclose GetModuleFileNameW TerminateProcess DecodePointer EncodePointer IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection GetStartupInfoW HeapSetInformation GetCommandLineA RaiseException RtlUnwind

user32

MessageBoxA SendMessageA GetWindowTextLengthA GetDlgItem ClientToScreen SetFocus ReleaseDC PostMessageA TranslateAcceleratorA LoadStringA SetMenuItemInfoA GetMenuCheckMarkDimensions GetMenuItemInfoA GetMenuItemCount GetMenu DialogBoxParamA GetAncestor GetParent DispatchMessageA TranslateMessage IsDialogMessageA ShowWindow CreateDialogParamA RegisterClassExA LoadCursorA LoadIconA SetWindowTextA GetWindowTextA IntersectRect SetRect PostQuitMessage InvertRect GetIconInfo GetCursorInfo DrawIcon GetDC GetMessageA LoadAcceleratorsA EndDeferWindowPos DefWindowProcA EndDialog InvalidateRect SetScrollPos DrawTextA GetSysColor SetScrollRange EndPaint FillRect GetSysColorBrush BeginPaint GetClientRect GetWindowThreadProcessId FindWindowExA OffsetRect SetForegroundWindow WaitForInputIdle FindWindowA CallWindowProcA DestroyMenu TrackPopupMenu AppendMenuA CreatePopupMenu

gdi32

DeleteDC GdiAlphaBlend StretchBlt SetStretchBltMode GetObjectA GetStockObject LineTo MoveToEx CreatePen Rectangle CreateCompatibleDC SetBkMode SetTextColor SetBkColor SelectObject CreateSolidBrush DeleteObject FillRgn CombineRgn CreateRectRgnIndirect CreateFontIndirectA

comdlg32

GetOpenFileNameA ChooseFontA

advapi32

CryptCreateHash CryptAcquireContextA CryptHashData RegCloseKey CryptReleaseContext CryptGenKey

avifil32

AVIBuildFilterA

msacm32

acmDriverOpen acmFormatTagDetailsA acmDriverClose acmDriverDetailsA

pdh

PdhGetFormattedCounterValue PdhCollectQueryData

urlmon

HlinkSimpleNavigateToMoniker HlinkNavigateString HlinkSimpleNavigateToString

Name

.text

Size

108KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text1

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

22KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.trace

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

103KB

Virtual Size

102KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_Trojan-Downloader.Win32.Upatre.gagx.46bd33f19fab3d16980d1727487e1677

kernel32

user32

gdi32

comdlg32

advapi32

avifil32

msacm32

pdh

urlmon

generic