164680cc5cdb4501deccfe790323eee8_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

164680cc5cdb4501deccfe790323eee8_JaffaCakes118
Size

151KB
MD5

164680cc5cdb4501deccfe790323eee8
SHA1

ee520b93efcc9bf6cecdcb638fa104a80314ead9
SHA256

effd5ccf264023c24a0e8fd87128f3774ad3ec936bfcdb2692b29a0efde50638
SHA512

f1dc0943be2889e8620719406d61c579c91c76765cdfdd3e9e6cfb76b634d054e87df8383945cbac5afbac0841fcb25968367129c619859cebbe9ebf90c94811
SSDEEP

3072:cBIqkYFEMLXQSbOqyWhnhMYeh3L1VkVZCPIUB:cPEmXQgOrWpqYeh7dww

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
164680cc5cdb4501deccfe790323eee8_JaffaCakes118

Files

164680cc5cdb4501deccfe790323eee8_JaffaCakes118
.exe windows:4 windows x86 arch:x86

c17a89c07783e1eef4d11c6dddcfdf1c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryW

msvbvm60

EVENT_SINK_GetIDsOfNames
EVENT_SINK_Invoke
ord666
ord667
Zombie_GetTypeInfo
ord595
ord598
ord631
ord632
ord526
EVENT_SINK_AddRef
DllFunctionCall
ord563
Zombie_GetTypeInfoCount
EVENT_SINK_Release
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord608
ord531
ord716
ord717
ProcCallEngine
ord535
ord644
ord576
ord578
ord685
ord100
ord616
ord580

Sections

.text
Size: 100KB - Virtual size: 97KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

cdata
Size: 43KB - Virtual size: 44KB