jaffacakes118_not-a-virus[.]RiskTool[.]Win32[.]IMEStartup[.]ah[.]bf7afe33c22a393d80ef213518db14ec

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_not-a-virus.RiskTool.Win32.IMEStartup.ah.bf7afe33c22a393d80ef213518db14ec
Size 2.4MB
Sample261014-gm5ehszshx
SHA256 6d467615a1a40bcf95e998100525173e3677ffce61e15d158523ee2825021bdb
MD5 bf7afe33c22a393d80ef213518db14ec
SHA1 923e9b10b9722e3d6a7b7419970cf6dcc9d6e1ad
SHA512 54f6ecbbfe1312b652c0506547feaeab1af653f86ece3e51f5103b862f5cc0ce27b83e5fb8c41e7eb73ba7b0d52fdc0b581352414d3954629b91e163087d39cc
SSDEEP 49152:kMbjw8kfJed1HgAWgm2MdYIlJgyYIvXRSj1a2W:7vwVxed1LW6YLgyYIfVr
TLSH
T16EC50222B6F254F2C604A1B005BB2737EA74AD061A39CFE3D394DD3B6D32650E63B116
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_not-a-virus.RiskTool.Win32.IMEStartup.ah.bf7afe33c22a393d80ef213518db14ec

File Explorer

jaffacakes118_not-a-virus.RiskTool.Win32.IMEStartup.ah.bf7afe33c22a393d80ef213518db14ec

.exe 2.4MB

jaffacakes118_not-a-virus.RiskTool.Win32.IMEStartup.ah.bf7afe33c22a393d80ef213518db14ec

IMPHASH 30e93ec0b90794345e44d2af0f8de467
SHA256 6d467615a1a40bcf95e998100525173e3677ffce61e15d158523ee2825021bdb
MD5 bf7afe33c22a393d80ef213518db14ec
SHA1 923e9b10b9722e3d6a7b7419970cf6dcc9d6e1ad
SHA512 54f6ecbbfe1312b652c0506547feaeab1af653f86ece3e51f5103b862f5cc0ce27b83e5fb8c41e7eb73ba7b0d52fdc0b581352414d3954629b91e163087d39cc
SSDEEP 49152:kMbjw8kfJed1HgAWgm2MdYIlJgyYIvXRSj1a2W:7vwVxed1LW6YLgyYIfVr
TLSH
T16EC50222B6F254F2C604A1B005BB2737EA74AD061A39CFE3D394DD3B6D32650E63B116
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

319473

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

FreeEnvironmentStringsA UnhandledExceptionFilter GetACP HeapSize TerminateProcess GetLocalTime GetSystemTime GetTimeZoneInformation RaiseException RtlUnwind GetStartupInfoA GetOEMCP GetCPInfo GetProcessVersion SetErrorMode GlobalFlags FreeEnvironmentStringsW GetFileTime GetFileSize TlsGetValue LocalReAlloc TlsSetValue TlsFree GlobalHandle TlsAlloc LocalAlloc lstrcmpA GetVersion GlobalGetAtomNameA GlobalAddAtomA GlobalFindAtomA GlobalDeleteAtom lstrcmpiA SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer DuplicateHandle lstrcpynA SetLastError FileTimeToLocalFileTime FileTimeToSystemTime LocalFree InterlockedDecrement InterlockedIncrement GetEnvironmentStrings GetEnvironmentStringsW SetHandleCount GetStdHandle GetFileType GetEnvironmentVariableA HeapDestroy HeapCreate VirtualFree SetEnvironmentVariableA LCMapStringA LCMapStringW VirtualAlloc IsBadWritePtr GetStringTypeA GetStringTypeW SetUnhandledExceptionFilter CompareStringA CompareStringW IsBadReadPtr IsBadCodePtr SetStdHandle WideCharToMultiByte MultiByteToWideChar GetCurrentProcess GetWindowsDirectoryA GetSystemDirectoryA CreateSemaphoreA ResumeThread ReleaseSemaphore EnterCriticalSection LeaveCriticalSection GetProfileStringA WriteFile ReadFile GetLastError WaitForMultipleObjects CreateFileA SetEvent FindResourceA LoadResource LockResource GetModuleFileNameA GetCurrentThreadId ExitProcess GlobalSize GlobalFree DeleteCriticalSection InitializeCriticalSection lstrcatA WinExec lstrcpyA FindNextFileA CloseHandle GlobalReAlloc HeapFree HeapReAlloc GetProcessHeap HeapAlloc GetFullPathNameA FreeLibrary LoadLibraryA lstrlenA GetVersionExA WritePrivateProfileStringA CreateThread CreateEventA Sleep GlobalAlloc GlobalLock GlobalUnlock GetTempPathA FindFirstFileA FindClose GetFileAttributesA DeleteFileA SetCurrentDirectoryA GetVolumeInformationA GetModuleHandleA GetProcAddress MulDiv GetCommandLineA GetTickCount WaitForSingleObject GetCurrentThread

user32

GetForegroundWindow SystemParametersInfoA TranslateMessage LoadIconA DrawFrameControl DrawEdge DrawFocusRect WindowFromPoint GetMessageA DispatchMessageA SetRectEmpty RegisterClipboardFormatA CreateIconFromResourceEx CreateIconFromResource DrawIconEx CreatePopupMenu AppendMenuA ModifyMenuA CreateMenu CreateAcceleratorTableA GetDlgCtrlID GetSubMenu EnableMenuItem ClientToScreen EnumDisplaySettingsA LoadImageA ShowWindow IsWindowEnabled TranslateAcceleratorA GetKeyState CopyAcceleratorTableA PostQuitMessage IsZoomed GetSystemMenu DeleteMenu GetClassInfoA DefWindowProcA GetMenu SetMenu PeekMessageA IsIconic SetFocus GetActiveWindow GetWindow DestroyAcceleratorTable SetWindowRgn GetMessagePos ScreenToClient ChildWindowFromPointEx CopyRect LoadBitmapA WinHelpA KillTimer SetTimer ReleaseCapture GetCapture SetCapture GetScrollRange SetScrollRange SetScrollPos InflateRect SetRect IntersectRect DestroyIcon UnregisterClassA OffsetRect IsWindowVisible EnableWindow RedrawWindow GetWindowLongA SetWindowLongA GetSysColor SetActiveWindow SetCursorPos LoadCursorA SetCursor GetDC FillRect IsRectEmpty ReleaseDC IsChild DestroyMenu SetForegroundWindow GetWindowRect EqualRect UpdateWindow ValidateRect InvalidateRect GetClientRect GetFocus GetWindowTextA GetWindowTextLengthA CharUpperA GetWindowDC BeginPaint EndPaint TabbedTextOutA DrawTextA GrayStringA GetDlgItem DestroyWindow CreateDialogIndirectParamA EndDialog GetNextDlgTabItem GetWindowPlacement RegisterWindowMessageA GetLastActivePopup GetMessageTime RemovePropA CallWindowProcA GetPropA UnhookWindowsHookEx SetPropA GetClassLongA CallNextHookEx SetWindowsHookExA CreateWindowExA GetMenuItemID GetMenuItemCount RegisterClassA GetScrollPos AdjustWindowRectEx MapWindowPoints SendDlgItemMessageA ScrollWindowEx IsDialogMessageA SetWindowTextA MoveWindow CheckMenuItem SetMenuItemBitmaps GetMenuState GetMenuCheckMarkDimensions GetClassNameA GetDesktopWindow LoadStringA GetSysColorBrush GetParent GetTopWindow PostMessageA IsWindow SetParent DestroyCursor SendMessageA SetWindowPos MessageBoxA GetCursorPos GetSystemMetrics EmptyClipboard SetClipboardData OpenClipboard GetClipboardData CloseClipboard wsprintfA PtInRect

gdi32

GetTextMetricsA LineTo Escape ExtTextOutA TextOutA RectVisible PtVisible GetViewportExtEx ExtSelectClipRgn SetBkColor CreateRectRgnIndirect SetStretchBltMode GetClipRgn CreatePolygonRgn SelectClipRgn DeleteObject CreateDIBitmap GetSystemPaletteEntries CreatePalette StretchBlt SelectPalette RealizePalette GetDIBits GetWindowExtEx GetViewportOrgEx GetWindowOrgEx BeginPath EndPath PathToRegion CreateEllipticRgn CreateRoundRectRgn GetTextColor GetBkMode GetBkColor GetROP2 GetStretchBltMode GetPolyFillMode CreateCompatibleBitmap CreateDCA CreateBitmap SelectObject GetObjectA CreatePen PatBlt FillRgn CreateRectRgn CombineRgn CreateSolidBrush MoveToEx ExcludeClipRect GetClipBox ScaleWindowExtEx SetWindowExtEx SetWindowOrgEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SetMapMode SetTextColor SetROP2 SetPolyFillMode SetBkMode RestoreDC SaveDC GetStockObject CreateFontIndirectA EndPage EndDoc DeleteDC StartDocA StartPage BitBlt CreateCompatibleDC Ellipse Rectangle LPtoDP DPtoLP GetCurrentObject RoundRect GetTextExtentPoint32A GetDeviceCaps

winmm

midiOutReset midiStreamRestart midiStreamStop midiStreamOut waveOutUnprepareHeader waveOutPrepareHeader waveOutWrite waveOutPause midiOutPrepareHeader midiStreamProperty waveOutReset waveOutClose waveOutGetNumDevs waveOutOpen midiOutUnprepareHeader midiStreamOpen midiStreamClose

winspool.drv

ClosePrinter DocumentPropertiesA OpenPrinterA

advapi32

RegOpenKeyExA RegCreateKeyExA RegCloseKey RegSetValueExA RegQueryValueA

shell32

ShellExecuteA Shell_NotifyIconA SHGetSpecialFolderPathA

ole32

OleUninitialize OleInitialize CLSIDFromString

oleaut32

UnRegisterTypeLi RegisterTypeLi LoadTypeLi

comctl32

ImageList_Destroy ord17

ws2_32

inet_ntoa WSACleanup closesocket WSAAsyncSelect recvfrom ioctlsocket recv getpeername accept

comdlg32

GetFileTitleA GetSaveFileNameA GetOpenFileNameA ChooseColorA