jaffacakes118_not-a-virus[.]RiskTool[.]VBS[.]LoadExec[.]a[.]3e2112d3ec8595a1e569202b8ade80f3

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_not-a-virus.RiskTool.VBS.LoadExec.a.3e2112d3ec8595a1e569202b8ade80f3
Size 92KB
Sample261015-2vb36adz71
SHA256 be4ce895798334b05a8ef12527524adbd99295bc1be591e249bdaf6ab708337d
MD5 3e2112d3ec8595a1e569202b8ade80f3
SHA1 26ead95f6744148c67c333776f9d391881f0bf0c
SHA512 3b078476605c964a51b8c9b30f59967e5f9be158b11e4a27196b435c8511e9b7f039af399bc082541746161d70cd7d2c7627b0b6ad3ec952d80bac9b8da851e3
SSDEEP 1536:dof494T0rS1SD60feu0FKsqSL66WL+nNos0EhDzUsBlYsvtCUi:Q49tS1DMgYGi9ERI4lYAfi
TLSH
T15793AD16B5DB81B2D8822A774CD556C1CB7ED90733A62ACBD7FC091A96102D04A39BF3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_not-a-virus.RiskTool.VBS.LoadExec.a.3e2112d3ec8595a1e569202b8ade80f3

File Explorer

jaffacakes118_not-a-virus.RiskTool.VBS.LoadExec.a.3e2112d3ec8595a1e569202b8ade80f3

.exe 92KB

jaffacakes118_not-a-virus.RiskTool.VBS.LoadExec.a.3e2112d3ec8595a1e569202b8ade80f3

IMPHASH 550e85221222ead5ae66b9582deb097a
SHA256 be4ce895798334b05a8ef12527524adbd99295bc1be591e249bdaf6ab708337d
MD5 3e2112d3ec8595a1e569202b8ade80f3
SHA1 26ead95f6744148c67c333776f9d391881f0bf0c
SHA512 3b078476605c964a51b8c9b30f59967e5f9be158b11e4a27196b435c8511e9b7f039af399bc082541746161d70cd7d2c7627b0b6ad3ec952d80bac9b8da851e3
SSDEEP 1536:dof494T0rS1SD60feu0FKsqSL66WL+nNos0EhDzUsBlYsvtCUi:Q49tS1DMgYGi9ERI4lYAfi
TLSH
T15793AD16B5DB81B2D8822A774CD556C1CB7ED90733A62ACBD7FC091A96102D04A39BF3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

35587

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

InterlockedExchange GetACP GetLocaleInfoA GetVersionExA RaiseException InitializeCriticalSection DeleteCriticalSection GetProcAddress LoadLibraryA lstrcpynA GetLastError GetModuleFileNameA lstrcpyA CreateDirectoryA GetTempFileNameA GetTempPathA SizeofResource LockResource LoadResource FindResourceA lstrlenA SetFilePointer CreateFileA CloseHandle WriteFile MultiByteToWideChar InterlockedDecrement FreeEnvironmentStringsW GetEnvironmentStrings LocalFree GetSystemInfo VirtualProtect GetCPInfo GetOEMCP GetStringTypeW GetStringTypeA IsBadCodePtr IsBadReadPtr GetFileType SetHandleCount FreeEnvironmentStringsA UnhandledExceptionFilter GetStdHandle LCMapStringW WideCharToMultiByte LCMapStringA ExitProcess RtlUnwind HeapFree GetSystemTimeAsFileTime GetModuleHandleA GetStartupInfoA GetCommandLineA HeapReAlloc HeapAlloc QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId VirtualQuery HeapDestroy HeapCreate VirtualFree VirtualAlloc IsBadWritePtr SetUnhandledExceptionFilter TerminateProcess GetCurrentProcess HeapSize GetEnvironmentStringsW

shell32

SHGetSpecialFolderPathA

shlwapi

StrStrA PathAppendA

rpcrt4

UuidCreate

ole32

CoCreateInstance CoInitializeSecurity CoSetProxyBlanket CoUninitialize CoInitializeEx

oleaut32

VariantClear VariantChangeType VariantInit SysFreeString SysAllocString