fe4f22e8d5f3a4b2bcd81bd69429c12b_JaffaCakes118

General

Target
fe4f22e8d5f3a4b2bcd81bd69429c12b_JaffaCakes118
Size 2.0MB
Sample240421-dwyrjsaa2v
SHA256 e0fb9bf9bd903a2ea4bc952b168482bd15af73dd1b4ae47529aa10fe6a9112a0
MD5 fe4f22e8d5f3a4b2bcd81bd69429c12b
SHA1 50eec07da09636ab7108e93a2a17224724d5f8c2
SHA512 6295463804ae0b84e90a6dc04d4a673fce7eea5c8f3a9017aae52eb4ea6c0a522e94fe8f9b5403cd42449a78aac438d0d53e44457581d67c4cd94886054b0ef2
SSDEEP 49152:rSgBqO4ZjnK6IoaAW4kBOSoyx7qwG9h+3vUZLeG2+fWPyGAt4Gjt6:rvanKNqKBkwY3VeDyGA1Q
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fe4f22e8d5f3a4b2bcd81bd69429c12b_JaffaCakes118

File Explorer

fe4f22e8d5f3a4b2bcd81bd69429c12b_JaffaCakes118

.exe 2.0MB

fe4f22e8d5f3a4b2bcd81bd69429c12b_JaffaCakes118

IMPHASH 4e0230218d44198d72f8950221b8a209
SHA256 e0fb9bf9bd903a2ea4bc952b168482bd15af73dd1b4ae47529aa10fe6a9112a0
MD5 fe4f22e8d5f3a4b2bcd81bd69429c12b
SHA1 50eec07da09636ab7108e93a2a17224724d5f8c2
SHA512 6295463804ae0b84e90a6dc04d4a673fce7eea5c8f3a9017aae52eb4ea6c0a522e94fe8f9b5403cd42449a78aac438d0d53e44457581d67c4cd94886054b0ef2
SSDEEP 49152:rSgBqO4ZjnK6IoaAW4kBOSoyx7qwG9h+3vUZLeG2+fWPyGAt4Gjt6:rvanKNqKBkwY3VeDyGA1Q
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

2021672

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetProcAddress RtlMoveMemory GetModuleHandleW WriteFile RtlFillMemory

msvbvm60

__vbaVarSub _CIcos _adj_fptan __vbaVarMove __vbaStrI4 __vbaVarVargNofree __vbaFreeVar __vbaAryMove __vbaStrVarMove __vbaLenBstr __vbaFreeVarList _adj_fdiv_m64 ord698 __vbaFreeObjList __vbaStrErrVarCopy _adj_fprem1 __vbaStrCat __vbaSetSystemError __vbaHresultCheckObj __vbaLenVar _adj_fdiv_m32 __vbaAryDestruct ord595 __vbaObjSet _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i __vbaVarTstLt __vbaRefVarAry __vbaBoolVarNull _CIsin ord631 __vbaChkstk ord526 EVENT_SINK_AddRef ord528 __vbaAryConstruct2 ord638 __vbaVarLikeVar DllFunctionCall _adj_fpatan __vbaRedim EVENT_SINK_Release __vbaNew _CIsqrt EVENT_SINK_QueryInterface __vbaExceptHandler __vbaStrToUnicode ord606 _adj_fprem _adj_fdivr_m64 ord607 __vbaFPException ord717 __vbaStrVarVal __vbaUbound __vbaVarCat ord644 ord537 _CIlog __vbaNew2 __vbaR8Str __vbaVar2Vec _adj_fdiv_m32i _adj_fdivr_m32i __vbaStrCopy __vbaI4Str __vbaFreeStrList _adj_fdivr_m32 _adj_fdiv_r ord100 __vbaI4Var __vbaAryLock __vbaVarAdd __vbaStrToAnsi __vbaVarDup __vbaVarCopy ord617 _CIatan __vbaStrMove __vbaCastObj _allmul _CItan __vbaAryUnlock _CIexp __vbaFreeStr __vbaFreeObj

Sharing

General

Malware Config

Signatures

File Explorer

fe4f22e8d5f3a4b2bcd81bd69429c12b_JaffaCakes118

kernel32

msvbvm60

generic