0f81a77eb8a411ff666383d6eda3063d_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0f81a77eb8a411ff666383d6eda3063d_JaffaCakes118
Size

1.7MB
MD5

0f81a77eb8a411ff666383d6eda3063d
SHA1

e72dfb4acacdfe212ae6cbf7cf82c28945b87261
SHA256

15f4e286262663e1d152c205b4f0716697717d0fa16fc2992d9be26869553ab5
SHA512

405279aa937950e1ef67a95de048273815d9c55776be3c766e936701feef3928577414b5a227257f4648a34171820c7b4568e86e295ec3281aa351559c445deb
SSDEEP

49152:IbqBldIp7WFwibJtmuc4lnDTEhEzJNxxdCdGY98pccne+:pzduWCibJE4lnXEGzJ3PCcYgdn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0f81a77eb8a411ff666383d6eda3063d_JaffaCakes118

Files

0f81a77eb8a411ff666383d6eda3063d_JaffaCakes118
.exe windows:4 windows x86 arch:x86

e540e3891253a89415a23f44c19b1c5c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

CallWindowProcA

kernel32

GetProcAddress
FreeResource
LoadResource
SizeofResource
GetModuleHandleA
LoadLibraryA
LockResource
FindResourceA

msvbvm60

ord516
__vbaCopyBytes
ord666
ord667
ord669
ord593
ord595
ord598
ord631
ord632
ord526
EVENT_SINK_AddRef
ord529
DllFunctionCall
EVENT_SINK_Release
ord600
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord711
ord717
ProcCallEngine
ord535
ord644
ord537
ord645
ord648
ord100
ord617
ord580

Sections

.text
Size: 52KB - Virtual size: 49KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ