168b066699f550382a8e1a0e7b41bcb8_JaffaCakes118 | Triage

Sharing

General

Target

168b066699f550382a8e1a0e7b41bcb8_JaffaCakes118
Size

124KB
MD5

168b066699f550382a8e1a0e7b41bcb8
SHA1

9630f85f54b9d9b3b2d887ff8270888fd37c451e
SHA256

192e5b4f13afc72e14b156d1d8b8e6e5d03fe483626eaf29803a57f3147070df
SHA512

646377c1124f8ee662e4c0341771dddb9f419336390a1d2aac6c600dcfd6f2f629c5ae24ec9620391116bb757e06898c2c2201f86a067455b3b69eb073478214
SSDEEP

3072:iLvmZ/yWHpB1lvqO5NEDtdhWuqlPm3DFkF4SAIFxN:iLvmZ6W/7qWauu0PgDzSD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
168b066699f550382a8e1a0e7b41bcb8_JaffaCakes118

Files

168b066699f550382a8e1a0e7b41bcb8_JaffaCakes118
.exe windows:4 windows x86 arch:x86

c705d47165cd05a5a57660285c189f7b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

CallWindowProcW
ShowWindow

kernel32

GetProcAddress
FreeResource
RtlMoveMemory
LoadResource
SizeofResource
LoadLibraryA
FreeLibrary
LockResource
ExitProcess

msvbvm60

ord588
ord589
MethCallEngine
ord516
ord598
ord525
ord632
EVENT_SINK_AddRef
DllFunctionCall
EVENT_SINK_Release
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord717
ProcCallEngine
ord644
ord645
ord100

Sections

.text
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 105KB - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ