b1d39ceff7e57ec494348822a29e4a74_JaffaCakes118

General

Target
b1d39ceff7e57ec494348822a29e4a74_JaffaCakes118
Size 408KB
Sample240616-fl7b2svblk
SHA256 1835d834555dc234695dce408bbcbe16fe8b22ff25e01a2a6e2c4428e30b7758
MD5 b1d39ceff7e57ec494348822a29e4a74
SHA1 9422d78bdb2c68ef8322deb2d5cd10ada7a177fb
SHA512 320c8bbd8c2e95ba2b5f131acd3ca2e14fe7db84d4cc6926fd806763387337ce94624226f312d83864f1f2e9124d3ddaef26ee0e47278e2c2584672b310f09d7
SSDEEP 6144:3nOIweNcFS+Ei3m/Yiku0sd3jyOfH8sHpenQFUs2ax:3nfweN0e1yOfH8sEQSs2ax
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b1d39ceff7e57ec494348822a29e4a74_JaffaCakes118

File Explorer

b1d39ceff7e57ec494348822a29e4a74_JaffaCakes118

.exe 408KB

b1d39ceff7e57ec494348822a29e4a74_JaffaCakes118

IMPHASH 1e6b456eed015cc8476b38993407e4c5
SHA256 1835d834555dc234695dce408bbcbe16fe8b22ff25e01a2a6e2c4428e30b7758
MD5 b1d39ceff7e57ec494348822a29e4a74
SHA1 9422d78bdb2c68ef8322deb2d5cd10ada7a177fb
SHA512 320c8bbd8c2e95ba2b5f131acd3ca2e14fe7db84d4cc6926fd806763387337ce94624226f312d83864f1f2e9124d3ddaef26ee0e47278e2c2584672b310f09d7
SSDEEP 6144:3nOIweNcFS+Ei3m/Yiku0sd3jyOfH8sHpenQFUs2ax:3nfweN0e1yOfH8sEQSs2ax
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

11248

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

oleaut32

SysReAllocString

kernel32

VirtualAlloc RtlMoveMemory WideCharToMultiByte

msvbvm60

__vbaVarSub __vbaVarTstGt __vbaStrI2 _CIcos _adj_fptan __vbaStrI4 __vbaVarMove __vbaVarVargNofree __vbaFreeVar __vbaAryMove __vbaLateIdCall __vbaLenBstr __vbaStrVarMove __vbaFreeVarList _adj_fdiv_m64 __vbaFpCDblR8 __vbaRaiseEvent __vbaFreeObjList ord516 ord517 __vbaStrErrVarCopy _adj_fprem1 __vbaRecAnsiToUni ord519 __vbaStrCat __vbaForEachCollAd __vbaLsetFixstr ord660 ord553 ord661 __vbaSetSystemError __vbaHresultCheckObj __vbaLenVar ord665 _adj_fdiv_m32 __vbaVarCmpGe __vbaAryDestruct __vbaLateMemSt __vbaExitProc ord300 __vbaI4Abs __vbaObjSet __vbaOnError _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i ord598 ord305 __vbaFpR4 ord599 ord306 __vbaStrFixstr __vbaForEachCollVar __vbaBoolVar __vbaBoolVarNull __vbaFpR8 __vbaVarTstLt __vbaRefVarAry _CIsin ord631 __vbaErase __vbaVarCmpGt ord632 __vbaChkstk EVENT_SINK_AddRef ord527 __vbaGenerateBoundsError __vbaStrCmp __vbaAryConstruct2 __vbaPrintObj __vbaI2I4 ord561 __vbaObjVar __vbaNextEachCollVar DllFunctionCall __vbaVarOr __vbaCastObjVar _adj_fpatan __vbaR4Var __vbaFixstrConstruct __vbaLateIdCallLd __vbaRedim __vbaStrR8 __vbaRecUniToAnsi EVENT_SINK_Release __vbaNew __vbaUI1I2 _CIsqrt __vbaVarAnd __vbaObjIs ord311 EVENT_SINK_QueryInterface __vbaExceptHandler ord313 __vbaStrToUnicode ord712 ord606 _adj_fprem _adj_fdivr_m64 __vbaFailedFriend ord608 __vbaVarCmpLe __vbaFPException __vbaInStrVar __vbaUbound __vbaStrVarVal ord534 __vbaVarCat __vbaCheckType __vbaI2Var __vbaLsetFixstrFree ord537 _CIlog __vbaErrorOverflow __vbaInStr __vbaNew2 __vbaVar2Vec __vbaR8Str _adj_fdiv_m32i _adj_fdivr_m32i __vbaStrCopy __vbaI4Str ord681 __vbaVarCmpLt __vbaFreeStrList _adj_fdivr_m32 _adj_fdiv_r ord685 ord100 __vbaVarTstNe __vbaI4Var __vbaVarCmpEq ord610 __vbaVarAdd __vbaAryLock __vbaStrToAnsi __vbaVarDup __vbaFpI2 __vbaVarCopy __vbaFpI4 ord616 ord617 __vbaLateMemCallLd _CIatan __vbaStrMove ord618 __vbaCastObj __vbaStrVarCopy ord650 _allmul __vbaLateIdSt __vbaLenVarB _CItan __vbaNextEachCollAd __vbaFPInt __vbaAryUnlock _CIexp __vbaMidStmtBstr __vbaFreeObj __vbaFreeStr ord581

Sharing

General

Malware Config

Signatures

File Explorer

b1d39ceff7e57ec494348822a29e4a74_JaffaCakes118

oleaut32

kernel32

msvbvm60

generic