28b7684c8dad7415b4cf5e2423edccd8_JaffaCakes118 | Triage

Sharing

General

Target

28b7684c8dad7415b4cf5e2423edccd8_JaffaCakes118
Size

616KB
MD5

28b7684c8dad7415b4cf5e2423edccd8
SHA1

7cd76f539f431c0ed65f6396b3fc08a8d99a307d
SHA256

b948ad92dc33b9371c3235b6eb699e956fcf7bea032bbd33a8fc76395dc85c22
SHA512

a5d489d48c3086f1cbfc034ff13e390198d4564ebdeb060166d9db2a521fc9951e81b5270ec14553b8c43767b5f49a6ed899fbbe3528e27fc04a533842a514c2
SSDEEP

12288:PamOVZUYyUhtKG6J+pJVmmtCFN7CGR4S3E0IVPBx3:QLyUhoG3vgLP+SUHn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
28b7684c8dad7415b4cf5e2423edccd8_JaffaCakes118

Files

28b7684c8dad7415b4cf5e2423edccd8_JaffaCakes118
.exe windows:4 windows x86 arch:x86

43e555ce1ada73f9954561ab0062f467

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

ord587
MethCallEngine
ord520
ord632
EVENT_SINK_AddRef
DllFunctionCall
EVENT_SINK_Release
ord601
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord606
ord713
ProcCallEngine
ord570
ord648
ord578
ord685
ord100
ord617
ord650

Sections

.text
Size: 600KB - Virtual size: 597KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ