jaffacakes118_not-a-virus[.]RiskTool[.]Win32[.]Agent[.]bahf[.]c8f3b1a8e8db7b4ca3f5e9b60c3b23fa

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_not-a-virus.RiskTool.Win32.Agent.bahf.c8f3b1a8e8db7b4ca3f5e9b60c3b23fa
Size 1.1MB
Sample261014-ghbxeagy7l
SHA256 d3ad943a5b59e1e071a3f61882d803e7879bb2bca2f632216a3f62386352e018
MD5 c8f3b1a8e8db7b4ca3f5e9b60c3b23fa
SHA1 7137b6c99d7bc7afa4bb73e1efe0b0bc3165ac5f
SHA512 3de4b90a6a9f28837283e0e2863207868f55cc9d01b49d62251f6ac56e1683799079436455c624f45656806c120c04cd014812d16512f055c1c7a903e34376d6
SSDEEP 12288:wsM+aTA3c+FK1vrlVYBVignBtZnfVq4cz1i5pP9kPQlq:LV4W8hqBYgnBLfVqx1Wjksq
TLSH
T10B3517316AC18031D3123331CE14EEEE356A6DB40DDA955FE2A43B394BB41B2DD3B65A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_not-a-virus.RiskTool.Win32.Agent.bahf.c8f3b1a8e8db7b4ca3f5e9b60c3b23fa

File Explorer

jaffacakes118_not-a-virus.RiskTool.Win32.Agent.bahf.c8f3b1a8e8db7b4ca3f5e9b60c3b23fa

.exe 1.1MB

jaffacakes118_not-a-virus.RiskTool.Win32.Agent.bahf.c8f3b1a8e8db7b4ca3f5e9b60c3b23fa

IMPHASH a5260ce0dbc6c02711ad81ba435690cb
SHA256 d3ad943a5b59e1e071a3f61882d803e7879bb2bca2f632216a3f62386352e018
MD5 c8f3b1a8e8db7b4ca3f5e9b60c3b23fa
SHA1 7137b6c99d7bc7afa4bb73e1efe0b0bc3165ac5f
SHA512 3de4b90a6a9f28837283e0e2863207868f55cc9d01b49d62251f6ac56e1683799079436455c624f45656806c120c04cd014812d16512f055c1c7a903e34376d6
SSDEEP 12288:wsM+aTA3c+FK1vrlVYBVignBtZnfVq4cz1i5pP9kPQlq:LV4W8hqBYgnBLfVqx1Wjksq
TLSH
T10B3517316AC18031D3123331CE14EEEE356A6DB40DDA955FE2A43B394BB41B2DD3B65A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

132748

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

oleacc

AccessibleObjectFromWindow

kernel32

InterlockedIncrement lstrcmpiW LoadLibraryExW TlsGetValue LeaveCriticalSection InterlockedDecrement EnterCriticalSection WideCharToMultiByte GetCurrentProcessId CreateThread MultiByteToWideChar SetFileAttributesW GetFileAttributesW GetProcessId GetModuleFileNameW CreateDirectoryW MulDiv GetModuleHandleW FindResourceW ReadConsoleW SetEndOfFile WriteConsoleW SetFilePointerEx FlushFileBuffers SetStdHandle FreeLibrary FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetConsoleMode GetConsoleCP EnumSystemLocalesW GetUserDefaultLCID LoadResource FindResourceExW LockResource Sleep SizeofResource GetProcessHeap DeleteCriticalSection HeapDestroy DecodePointer HeapAlloc RaiseException HeapReAlloc GetLastError HeapSize InitializeCriticalSectionAndSpinCount HeapFree GetProcAddress IsValidLocale GetFileType GetACP WriteFile GetStdHandle GetModuleHandleExW ExitProcess VirtualQuery VirtualProtect GetSystemInfo RtlUnwind QueryPerformanceCounter GetStartupInfoW TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter WaitForSingleObjectEx ResetEvent SetEvent GetLocaleInfoW LCMapStringW CompareStringW GetCPInfo GetSystemTimeAsFileTime TlsFree ReadFile SetFilePointer CreateFileW CloseHandle GetFileSize SetLastError GetCurrentThreadId GlobalAlloc GlobalLock GlobalUnlock lstrcmpW GetCurrentProcess GetEnvironmentVariableW TlsAlloc FormatMessageW LocalFree IsDebuggerPresent OutputDebugStringW EncodePointer InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree LoadLibraryExA GetStringTypeW CreateEventW TlsSetValue

user32

ReleaseDC UpdateWindow BeginPaint UnregisterClassW EndPaint GetDesktopWindow CallWindowProcW PostMessageW CharNextW MessageBoxW ShowWindow InvalidateRect GetWindowLongW GetWindowThreadProcessId GetMessageW DefWindowProcW GetWindowRect DestroyWindow GetDC IsWindowVisible SetWindowPos EqualRect EnumChildWindows CreateWindowExW GetSystemMetrics RegisterClassExW IsWindow DispatchMessageW SetTimer PeekMessageW MoveWindow GetWindowTextW GetCursorPos SetForegroundWindow ReleaseCapture RegisterWindowMessageW GetParent GetClassInfoExW GetDlgItem GetClientRect SetCapture SetFocus CreateAcceleratorTableW GetSysColor IsChild DestroyAcceleratorTable ClientToScreen RedrawWindow InvalidateRgn SetWindowTextW SendMessageW ScreenToClient FillRect GetFocus GetWindow GetWindowTextLengthW EnumWindows LoadBitmapW SetLayeredWindowAttributes TranslateMessage LoadCursorW GetClassNameW SetWindowLongW DrawTextW KillTimer

gdi32

GetObjectW DeleteDC GetStockObject CreateCompatibleBitmap CreateSolidBrush CreateFontIndirectW SetBkMode SetTextColor GetDIBits CreateCompatibleDC SelectObject BitBlt DeleteObject GetDeviceCaps

advapi32

CryptCreateHash CryptAcquireContextW RegQueryInfoKeyW RegDeleteKeyW RegEnumKeyExW RegOpenKeyExW RegDeleteValueW RegCloseKey RegCreateKeyExW RegSetValueExW CryptHashData CryptDestroyHash CryptGetHashParam CryptReleaseContext RegEnumKeyW RegQueryValueExW

shell32

SHGetFolderPathW ShellExecuteW ShellExecuteExW

ole32

OleLockRunning CoGetClassObject OleUninitialize StringFromGUID2 CoTaskMemRealloc CreateStreamOnHGlobal OleInitialize CLSIDFromString CLSIDFromProgID CoCreateGuid CoTaskMemFree CoCreateInstance CoTaskMemAlloc CoUninitialize CoInitialize

oleaut32

LoadTypeLi OleCreateFontIndirect VarBstrCat SysStringLen SysAllocStringLen LoadRegTypeLi VariantClear VarBstrCmp SysAllocString SysFreeString VariantInit VarUI4FromStr

shlwapi

UrlEscapeW PathAppendW PathAddBackslashW UrlUnescapeW

wininet

InternetCloseHandle HttpSendRequestW InternetCrackUrlW InternetOpenW HttpOpenRequestW InternetConnectW