365336aff9d198f578fa7225a068feaf_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

365336aff9d198f578fa7225a068feaf_JaffaCakes118
Size

327KB
MD5

365336aff9d198f578fa7225a068feaf
SHA1

bb3ca105f212d534c1b360049b83d481ca241373
SHA256

f172197bef84eb082de7219c1b23950f9920c62d54131f8721d7cd4024b78a0a
SHA512

b0f591c7838aa97419adad3e00800ee6eb88bf47d9483e69713a721c25113a678d3e91fad9cffd1cffacb69d6baadd052a0b55e9228e646765d0b49a5da47ed3
SSDEEP

6144:4H+nfUy9LjYaxhROUcwIquruLEQzw3QVhk1iQZ4cVdzSuRIY2ESkmNvUJX5s74wq:m+nfUIvrROA6utwAvm1bdRkESkmNsR5H

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
365336aff9d198f578fa7225a068feaf_JaffaCakes118

Files

365336aff9d198f578fa7225a068feaf_JaffaCakes118
.exe windows:4 windows x86 arch:x86

d110e0198aaccc67ae7d4d09199173b8

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

CallWindowProcW

kernel32

GetProcAddress
RtlMoveMemory
LoadLibraryA

msvbvm60

MethCallEngine
ord516
ord631
EVENT_SINK_AddRef
DllFunctionCall
EVENT_SINK_Release
EVENT_SINK_QueryInterface
__vbaExceptHandler
ProcCallEngine
ord537
ord644
ord100
ord616

Sections

.text
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 164KB - Virtual size: 164KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ