kutaki | 1299315c3032491208ef04f8674aa5fa_JaffaCakes118

General

Target
1299315c3032491208ef04f8674aa5fa_JaffaCakes118
Size 603KB
Sample240504-nylj4sfh32
SHA256 11724aa717338d3fa58fc1c6d92cdf9b64ca986b0e2f6cde1a5d795d6277fc4c
MD5 1299315c3032491208ef04f8674aa5fa
SHA1 f320997f6f3479ef392be9f35e1f5b600f9f42f1
SHA512 41025d5293d43d630c932d1b186c75c793cf9430222a90e02c719c2b5a436715c3298626ef1c1567f92a42e468f8abb5c053e44c38d339b1e75c5b329ed8474a
SSDEEP 6144:BHmz3+U3iFSMYN5Exf2o9LnIH8iN/wfGB4Dosj1E+6VVPviDlSOcwhxAwOhgYwj7:9rtZmXN4zJpGPqlSpwhm4s5bsGSCs5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

kutaki

Malware Config

Signatures

Kutaki Executable 1 IoCs

resource	yara_rule
sample	family_kutaki

Kutaki family
kutaki

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1299315c3032491208ef04f8674aa5fa_JaffaCakes118

File Explorer

1299315c3032491208ef04f8674aa5fa_JaffaCakes118

.exe 603KB

1299315c3032491208ef04f8674aa5fa_JaffaCakes118

IMPHASH 20752a787404615c07611338f16d574f
SHA256 11724aa717338d3fa58fc1c6d92cdf9b64ca986b0e2f6cde1a5d795d6277fc4c
MD5 1299315c3032491208ef04f8674aa5fa
SHA1 f320997f6f3479ef392be9f35e1f5b600f9f42f1
SHA512 41025d5293d43d630c932d1b186c75c793cf9430222a90e02c719c2b5a436715c3298626ef1c1567f92a42e468f8abb5c053e44c38d339b1e75c5b329ed8474a
SSDEEP 6144:BHmz3+U3iFSMYN5Exf2o9LnIH8iN/wfGB4Dosj1E+6VVPviDlSOcwhxAwOhgYwj7:9rtZmXN4zJpGPqlSpwhm4s5bsGSCs5
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Kutaki Executable
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

12388

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

__vbaVarTstGt __vbaVarSub ord690 __vbaStrI2 _CIcos _adj_fptan __vbaStrI4 __vbaHresultCheck __vbaVarMove __vbaVarVargNofree __vbaAryMove __vbaFreeVar __vbaLenBstr __vbaLateIdCall __vbaStrVarMove ord696 __vbaEnd __vbaPut3 __vbaFreeVarList _adj_fdiv_m64 ord698 __vbaNextEachVar __vbaFreeObjList ord516 __vbaVarIndexLoadRef __vbaStrErrVarCopy _adj_fprem1 __vbaRecAnsiToUni ord518 __vbaVarCmpNe __vbaStrCat __vbaLsetFixstr ord660 __vbaSetSystemError __vbaLenBstrB __vbaHresultCheckObj __vbaLenVar _adj_fdiv_m32 __vbaAryVar ord667 __vbaAryDestruct ord591 __vbaVarIndexLoadRefLock __vbaVarForInit __vbaExitProc ord300 __vbaStrLike __vbaObjSet __vbaOnError ord595 ord596 _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i __vbaVarIndexLoad ord598 ord306 __vbaStrFixstr ord520 __vbaBoolVarNull __vbaRefVarAry __vbaFpR8 _CIsin __vbaErase __vbaVarCmpGt __vbaVargVarMove ord525 ord632 __vbaChkstk ord526 __vbaFileClose EVENT_SINK_AddRef ord528 __vbaGenerateBoundsError __vbaStrCmp ord529 __vbaGet3 __vbaAryConstruct2 __vbaVarTstEq __vbaPutOwner4 __vbaObjVar __vbaI2I4 DllFunctionCall ord563 __vbaVarOr ord670 ord564 __vbaCastObjVar __vbaLbound _adj_fpatan __vbaFixstrConstruct __vbaLateIdCallLd __vbaRedim __vbaStrR8 __vbaRecUniToAnsi EVENT_SINK_Release __vbaNew ord600 ord601 __vbaUI1I2 _CIsqrt __vbaObjIs __vbaVarAnd EVENT_SINK_QueryInterface __vbaStr2Vec __vbaUI1I4 __vbaExceptHandler ord711 __vbaStrToUnicode __vbaPrintFile ord712 ord713 _adj_fprem _adj_fdivr_m64 ord607 ord608 ord716 __vbaFPException __vbaInStrVar ord717 __vbaUbound __vbaStrVarVal __vbaVarCat ord535 __vbaLsetFixstrFree __vbaI2Var ord644 ord537 ord645 _CIlog __vbaErrorOverflow __vbaFileOpen __vbaVarLateMemCallLdRf __vbaVar2Vec __vbaInStr ord570 ord648 __vbaR8Str __vbaNew2 _adj_fdiv_m32i _adj_fdivr_m32i __vbaVarSetObj ord573 __vbaStrCopy __vbaI4Str ord681 __vbaVarCmpLt __vbaFreeStrList ord576 _adj_fdivr_m32 _adj_fdiv_r ord685 ord100 __vbaVarTstNe __vbaVarSetVar __vbaI4Var __vbaVarCmpEq ord689 ord610 __vbaAryLock __vbaVarAdd __vbaStrToAnsi ord612 __vbaVarDup __vbaVarLateMemCallLd ord616 __vbaVarCopy __vbaFpI4 __vbaLateMemCallLd ord617 _CIatan __vbaCastObj __vbaAryCopy __vbaStrMove __vbaForEachVar __vbaStrVarCopy __vbaR8IntI4 ord619 _allmul _CItan __vbaAryUnlock __vbaUI1Var __vbaVarForNext _CIexp __vbaFreeStr __vbaFreeObj ord581

Sharing