jaffacakes118_not-a-virus[.]Downloader[.]Win32[.]Agent[.]kpue[.]d93d89c337c9e507785d879394aad592

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_not-a-virus.Downloader.Win32.Agent.kpue.d93d89c337c9e507785d879394aad592
Size 844KB
Sample261014-ea9glaxzhs
SHA256 387ea41f0d593df8f4e3008141f4e6abee2254f04a7f894b2cafe04ad57fe86d
MD5 d93d89c337c9e507785d879394aad592
SHA1 2ada5b6a0a1044325912a4459c17799757a113de
SHA512 0372b538010d497c289f6327179cfa01419f2ce40c21c1a8776c1e23c0942dd7ffc19c0bba2cd0a9c76f396077cb6276a2556373c8150860582363b642424de3
SSDEEP 24576:DONY7jGUc/X2/ST/rQLOHCWZ5DEnXY9gP57WoQ1Tfv:D4YCS8aOHtqP5CoQ1TX
TLSH
T14A05BF23B5C2C077C163007042AA6B3699BDFB310A21959FA3D82B5D5E705D1BF3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_not-a-virus.Downloader.Win32.Agent.kpue.d93d89c337c9e507785d879394aad592

File Explorer

jaffacakes118_not-a-virus.Downloader.Win32.Agent.kpue.d93d89c337c9e507785d879394aad592

.exe 844KB

jaffacakes118_not-a-virus.Downloader.Win32.Agent.kpue.d93d89c337c9e507785d879394aad592

IMPHASH a64b1fbf6b6b07d33b8b10b901b1f966
SHA256 387ea41f0d593df8f4e3008141f4e6abee2254f04a7f894b2cafe04ad57fe86d
MD5 d93d89c337c9e507785d879394aad592
SHA1 2ada5b6a0a1044325912a4459c17799757a113de
SHA512 0372b538010d497c289f6327179cfa01419f2ce40c21c1a8776c1e23c0942dd7ffc19c0bba2cd0a9c76f396077cb6276a2556373c8150860582363b642424de3
SSDEEP 24576:DONY7jGUc/X2/ST/rQLOHCWZ5DEnXY9gP57WoQ1Tfv:D4YCS8aOHtqP5CoQ1TX
TLSH
T14A05BF23B5C2C077C163007042AA6B3699BDFB310A21959FA3D82B5D5E705D1BF3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

529784

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\Fly3110\source\repos\installer2_2017\Release\finder.pdb

kernel32

Sleep SetEvent CloseHandle ExitProcess CreateEventA GetLastError AreFileApisANSI ReadFile TryEnterCriticalSection HeapCreate HeapFree EnterCriticalSection GetFullPathNameW WriteFile GetDiskFreeSpaceW OutputDebugStringA LockFile LeaveCriticalSection InitializeCriticalSection SetFilePointer GetFullPathNameA SetEndOfFile UnlockFileEx GetTempPathW CreateMutexW WaitForSingleObject CreateFileW GetFileAttributesW GetCurrentThreadId UnmapViewOfFile HeapValidate HeapSize MultiByteToWideChar FormatMessageW GetDiskFreeSpaceA GetFileAttributesExW OutputDebugStringW FlushViewOfFile CreateFileA LoadLibraryA WaitForSingleObjectEx GetFileAttributesA HeapReAlloc GetSystemInfo LoadLibraryW HeapAlloc HeapCompact HeapDestroy UnlockFile GetProcAddress LocalFree LockFileEx GetFileSize DeleteCriticalSection GetCurrentProcessId GetProcessHeap SystemTimeToFileTime FreeLibrary WideCharToMultiByte GetSystemTimeAsFileTime GetSystemTime FormatMessageA CreateFileMappingW MapViewOfFile QueryPerformanceCounter GetTickCount FlushFileBuffers CopyFileA lstrcmpA FindClose FindNextFileA FindFirstFileA GetModuleFileNameA DeleteFileA GetThreadTimes DeleteFileW GetTempPathA SetLastError InitializeCriticalSectionAndSpinCount CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW EncodePointer DecodePointer GetCPInfo CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent ResetEvent IsDebuggerPresent GetStartupInfoW InitializeSListHead RtlUnwind RaiseException LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetStdHandle GetACP GetCurrentThread GetFileType GetConsoleCP GetConsoleMode IsValidLocale GetUserDefaultLCID EnumSystemLocalesW SetFilePointerEx GetTimeZoneInformation FindFirstFileExA IsValidCodePage GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA SetStdHandle MoveFileExW ReadConsoleW WriteConsoleW

advapi32

RegSetValueExA RegCloseKey RegGetValueA RegCreateKeyExA RegOpenKeyExA

shell32

ShellExecuteExA

rpcrt4

UuidCreate UuidToStringA

urlmon

URLDownloadToFileA

wininet

HttpQueryInfoA InternetOpenA InternetCloseHandle HttpSendRequestA InternetConnectA HttpOpenRequestA InternetSetOptionA InternetReadFile

crypt32

CryptUnprotectData