0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118

General

Target
0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118
Size 336KB
Sample240625-1a2bwathnb
SHA256 958c736bb73157af0bf2ad7715e56b0cc7264cc4b844db71778d817f60e9ef0c
MD5 0f96ee2962b0c0be8974f151205be9d3
SHA1 7af5781510cc7ddd6a7c4a06c0cef142c0e3bb0a
SHA512 d1440591b81c8dd833275de2b6607b9888d6236cbc54f0e70f832ef7652d1e5f094e66b5f2ffd197fcdfdb96f410aa510bd114638fd91d1ea5a6deb8c535f610
SSDEEP 6144:2ofwe61ykJTbHho6VlWcF302/ZHQ9dNOaeJ:InBJWcFpQ9d4rJ
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118

File Explorer

0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118

.exe 336KB

0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118

IMPHASH 45588a179c45573ec9a63de2f1081bac
SHA256 958c736bb73157af0bf2ad7715e56b0cc7264cc4b844db71778d817f60e9ef0c
MD5 0f96ee2962b0c0be8974f151205be9d3
SHA1 7af5781510cc7ddd6a7c4a06c0cef142c0e3bb0a
SHA512 d1440591b81c8dd833275de2b6607b9888d6236cbc54f0e70f832ef7652d1e5f094e66b5f2ffd197fcdfdb96f410aa510bd114638fd91d1ea5a6deb8c535f610
SSDEEP 6144:2ofwe61ykJTbHho6VlWcF302/ZHQ9dNOaeJ:InBJWcFpQ9d4rJ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5296

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

WriteProcessMemory

msvbvm60

_CIcos _adj_fptan __vbaVarMove __vbaVarVargNofree __vbaFreeVar __vbaAryMove __vbaStrVarMove __vbaLenBstr ord696 __vbaFreeVarList _adj_fdiv_m64 __vbaFreeObjList ord516 _adj_fprem1 __vbaRecAnsiToUni ord628 __vbaCopyBytes __vbaStrCat __vbaSetSystemError __vbaLenBstrB __vbaHresultCheckObj _adj_fdiv_m32 __vbaAryDestruct __vbaObjSet ord595 _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i _CIsin ord631 __vbaErase ord632 __vbaVarZero __vbaChkstk EVENT_SINK_AddRef __vbaGenerateBoundsError __vbaAryConstruct2 DllFunctionCall __vbaCastObjVar __vbaLbound _adj_fpatan __vbaLateIdCallLd __vbaRedim __vbaRecUniToAnsi EVENT_SINK_Release __vbaUI1I2 _CIsqrt EVENT_SINK_QueryInterface __vbaExceptHandler __vbaStrToUnicode _adj_fprem _adj_fdivr_m64 __vbaLateIdStAd ord608 __vbaFPException ord717 __vbaStrVarVal __vbaUbound __vbaVarCat ord537 ord644 _CIlog __vbaErrorOverflow __vbaNew2 __vbaVar2Vec _adj_fdiv_m32i _adj_fdivr_m32i __vbaStrCopy Zombie_AddRef ord681 __vbaFreeStrList _adj_fdivr_m32 _adj_fdiv_r ord100 __vbaI4Var __vbaAryLock __vbaStrToAnsi __vbaVarDup __vbaVerifyVarObj __vbaFpI4 ord616 _CIatan __vbaAryCopy __vbaStrMove _allmul _CItan __vbaAryUnlock _CIexp __vbaFreeStr __vbaI4ErrVar __vbaFreeObj ord581

Sharing

General

Malware Config

Signatures

File Explorer

0f96ee2962b0c0be8974f151205be9d3_JaffaCakes118

kernel32

msvbvm60

generic