Static task
static1
Behavioral task
behavioral1
Sample
148038013d931bf31372d4831cf6881c_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
148038013d931bf31372d4831cf6881c_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
148038013d931bf31372d4831cf6881c_JaffaCakes118
-
Size
76KB
-
MD5
148038013d931bf31372d4831cf6881c
-
SHA1
03a3a3b90a0d42b02e056a2c987fb01ae2c48970
-
SHA256
e6627bff38f44e04909ccf52660d87b836b238afd05793646e7940ffb2ae466f
-
SHA512
22f861cca0e37f3f9b2f8935d4f08620996d1504fd5dae22a3710dc0262fd6a77dcbd03a6b034b9f7e26f8ad00ed3be2086d95b1c22f46095e180d169b2be3bd
-
SSDEEP
1536:tn8uIQqWcoceN6v/j1bJ6nJbivn78fDf1m/hvuKvcLUpttJ:t9Njcoce0v/jRJ6nJbU76Df1KB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 148038013d931bf31372d4831cf6881c_JaffaCakes118
Files
-
148038013d931bf31372d4831cf6881c_JaffaCakes118.exe windows:4 windows x86 arch:x86
7edff8dfdd1c20cc2c4ee9c62ef3da14
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaVarTstGt
__vbaVarSub
__vbaStrI2
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaVarVargNofree
__vbaFreeVar
__vbaAryMove
__vbaLenBstr
__vbaLateIdCall
__vbaStrVarMove
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
__vbaFreeObjList
__vbaStrErrVarCopy
_adj_fprem1
__vbaRecAnsiToUni
ord519
__vbaResume
__vbaStrCat
__vbaVarCmpNe
ord553
__vbaLsetFixstr
__vbaRecDestruct
__vbaSetSystemError
__vbaHresultCheckObj
__vbaVargVarCopy
__vbaLenVar
_adj_fdiv_m32
__vbaAryVar
__vbaAryDestruct
__vbaVarForInit
__vbaForEachCollObj
ord593
__vbaExitProc
ord594
ord595
__vbaOnError
__vbaObjSet
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
ord598
ord520
__vbaBoolVar
__vbaStrFixstr
__vbaBoolVarNull
_CIsin
ord631
__vbaErase
__vbaNextEachCollObj
ord525
ord632
__vbaChkstk
__vbaFileClose
ord526
EVENT_SINK_AddRef
ord528
__vbaGenerateBoundsError
ord529
__vbaStrCmp
__vbaVarTstEq
__vbaPutOwner3
__vbaAryConstruct2
ord561
__vbaI2I4
DllFunctionCall
ord563
__vbaVarOr
__vbaCastObjVar
__vbaLbound
__vbaRedimPreserve
_adj_fpatan
__vbaLateIdCallLd
__vbaRedim
__vbaRecUniToAnsi
EVENT_SINK_Release
ord600
__vbaUI1I2
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord711
__vbaStrToUnicode
ord606
_adj_fprem
_adj_fdivr_m64
ord607
ord608
ord716
__vbaFPException
__vbaInStrVar
ord532
__vbaStrVarVal
__vbaUbound
__vbaVarCat
ord537
ord644
ord645
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaNew2
__vbaInStr
ord648
__vbaVar2Vec
__vbaR8Str
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord685
ord100
ord579
__vbaVarTstNe
__vbaI4Var
__vbaVarCmpEq
__vbaAryLock
__vbaVarDup
__vbaStrToAnsi
__vbaFpI2
ord616
__vbaVarCopy
__vbaFpI4
__vbaRecDestructAnsi
ord617
_CIatan
__vbaCastObj
ord618
__vbaStrMove
__vbaAryCopy
ord619
__vbaStrVarCopy
ord542
ord650
ord543
_allmul
__vbaLateIdSt
ord544
_CItan
ord546
__vbaFPInt
ord547
__vbaAryUnlock
__vbaVarForNext
_CIexp
ord580
__vbaFreeStr
__vbaFreeObj
__vbaRecAssign
Sections
.text Size: 64KB - Virtual size: 63KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ