3c637427af826f877a50c5a8763fe4f0_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3c637427af826f877a50c5a8763fe4f0_JaffaCakes118
Size

290KB
MD5

3c637427af826f877a50c5a8763fe4f0
SHA1

a636eb476a97c0508bf47863097b96ba91504c60
SHA256

e2b49e20de75631bdd79296ff05a0ea0eee4156b48cb8d5c90743849f8b81f54
SHA512

466281b0b1003ff7683de68e3b3281b9aa92353b2c7e47a395ed23b5e35df9a3215729449964e4c3950abb79130e2e740d84075bc11c7cd1ce4ffa3c51959ea6
SSDEEP

6144:4UCGe24YWjgOkGjNKVoWvsBN7UzedbNzOKlUaZkC/HiUEnaBmLRTAP:4UC/PjgOJNKVL+NwzedZzOKlPD7Q9W

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3c637427af826f877a50c5a8763fe4f0_JaffaCakes118

Files

3c637427af826f877a50c5a8763fe4f0_JaffaCakes118
.exe windows:4 windows x86 arch:x86

dcbf84ca814088e180b9592d4a241c32

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadResource
LoadLibraryA
LockResource
ExitProcess

msvbvm60

ord696
ord698
MethCallEngine
ord632
EVENT_SINK_AddRef
DllFunctionCall
EVENT_SINK_Release
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord717
ProcCallEngine
ord644
ord100

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 264KB - Virtual size: 264KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ