kutaki | 298e2c218c31e00ac6d6bc11dfc7fd75_JaffaCakes118

General

Target
298e2c218c31e00ac6d6bc11dfc7fd75_JaffaCakes118
Size 2.9MB
Sample240509-mntbjafg99
SHA256 1ddce63c7a5e53f5944b9dc55cc5efc9c9a573d56a44b9670ea80f4c48cfe86c
MD5 298e2c218c31e00ac6d6bc11dfc7fd75
SHA1 c02d0de4f2e58440e2630d082db446a812f98447
SHA512 6eeb73d87e77150daf79ba4706e6eac565d0b6d6d2b5dd86ad1eef3a888d2a9bb3fe5a1d565a803200e30332be889c275e755003760545bc7eb4dc123fd2fb40
SSDEEP 49152:xrMYcFy2WGmZOBBHtdD57nxG9ijgQO1PMDozYAPz2U:xCpmZKHtdD57nxGRMDoMu2
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

kutaki

Malware Config

Signatures

Kutaki Executable 1 IoCs

resource	yara_rule
sample	family_kutaki

Kutaki family
kutaki

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
298e2c218c31e00ac6d6bc11dfc7fd75_JaffaCakes118

File Explorer

298e2c218c31e00ac6d6bc11dfc7fd75_JaffaCakes118

.exe 2.9MB

298e2c218c31e00ac6d6bc11dfc7fd75_JaffaCakes118

IMPHASH 53e36e76a5ef7500b8803c235e8e5bf8
SHA256 1ddce63c7a5e53f5944b9dc55cc5efc9c9a573d56a44b9670ea80f4c48cfe86c
MD5 298e2c218c31e00ac6d6bc11dfc7fd75
SHA1 c02d0de4f2e58440e2630d082db446a812f98447
SHA512 6eeb73d87e77150daf79ba4706e6eac565d0b6d6d2b5dd86ad1eef3a888d2a9bb3fe5a1d565a803200e30332be889c275e755003760545bc7eb4dc123fd2fb40
SSDEEP 49152:xrMYcFy2WGmZOBBHtdD57nxG9ijgQO1PMDozYAPz2U:xCpmZKHtdD57nxGRMDoMu2
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Kutaki Executable
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

14596

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

__vbaVarSub __vbaStrI2 _CIcos _adj_fptan __vbaStrI4 __vbaVarMove __vbaVarVargNofree __vbaFreeVar __vbaAryMove __vbaLateIdCall __vbaStrVarMove __vbaLenBstr __vbaEnd __vbaFreeVarList __vbaPut3 _adj_fdiv_m64 __vbaRaiseEvent __vbaFreeObjList ord516 ord517 _adj_fprem1 __vbaRecAnsiToUni __vbaStrCat __vbaLsetFixstr __vbaSetSystemError __vbaHresultCheckObj _adj_fdiv_m32 ord666 ord667 __vbaAryDestruct __vbaLateMemSt __vbaVarForInit __vbaForEachCollObj ord593 __vbaExitProc ord300 ord594 __vbaObjSet __vbaOnError ord595 _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i ord598 __vbaFpR4 ord306 ord520 __vbaFpR8 __vbaBoolVarNull _CIsin __vbaNextEachCollObj ord632 ord525 __vbaChkstk ord526 __vbaFileClose EVENT_SINK_AddRef __vbaGenerateBoundsError __vbaExitEachColl ord529 __vbaStrCmp __vbaGet3 __vbaVarTstEq __vbaAryConstruct2 __vbaPutOwner3 __vbaObjVar __vbaI2I4 DllFunctionCall __vbaVarLateMemSt __vbaRedimPreserve __vbaStrR4 _adj_fpatan __vbaLateIdCallLd __vbaRedim __vbaRecUniToAnsi EVENT_SINK_Release ord600 __vbaUI1I2 _CIsqrt __vbaVarAnd EVENT_SINK_QueryInterface __vbaUI1I4 __vbaVarMul __vbaExceptHandler __vbaPrintFile ord712 __vbaStrToUnicode ord606 _adj_fprem _adj_fdivr_m64 ord608 ord716 __vbaFPException ord717 __vbaUbound __vbaGetOwner3 __vbaStrVarVal __vbaVarCat ord535 ord644 ord537 ord645 _CIlog __vbaErrorOverflow __vbaFileOpen __vbaInStr __vbaR8Str __vbaNew2 ord570 __vbaVar2Vec ord648 __vbaVarInt _adj_fdiv_m32i _adj_fdivr_m32i ord573 __vbaStrCopy __vbaI4Str __vbaFreeStrList __vbaVarCmpLt _adj_fdivr_m32 _adj_fdiv_r ord578 ord685 ord100 __vbaVarTstNe __vbaVarSetVar __vbaI4Var __vbaLateMemCall __vbaVarAdd __vbaAryLock __vbaVarDup __vbaStrToAnsi __vbaVarCopy __vbaFpI4 ord616 __vbaVarLateMemCallLd __vbaLateMemCallLd ord617 _CIatan __vbaCastObj __vbaStrMove __vbaR8IntI4 __vbaStrVarCopy ord619 ord650 _allmul __vbaLateIdSt _CItan __vbaFPInt __vbaAryUnlock __vbaVarForNext _CIexp __vbaFreeObj __vbaFreeStr ord581

Sharing