40fc27954fd388d975826990735dfe17_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

40fc27954fd388d975826990735dfe17_JaffaCakes118
Size

40KB
MD5

40fc27954fd388d975826990735dfe17
SHA1

bcfb4081a13885ebcf3e3be8f7c62fc66811645f
SHA256

dde4fc579cb43e260af7ea304dd16b7aa56718e859f1371bc96f2d3e7a509c0c
SHA512

b12f83ea601130a5c4a366829fe46d41d1b8e4db4014c69d3cfe17bcebc682462b5bb9e4adefe704303c4a74989d8cadee8053da5b725887ed8ec2d93c28db8e
SSDEEP

384:juCjzbiG2tD7HExQnSwjCMGrdrEVGlHERUICDf/wNiccFPSz2XuvVVs:ju6/uHHEXMGrdrEvRUvT/wNZyevVVs

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
40fc27954fd388d975826990735dfe17_JaffaCakes118

Files

40fc27954fd388d975826990735dfe17_JaffaCakes118
.exe windows:4 windows x86 arch:x86

840d010528053706ea6bf67601f29d4e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

ord621
ord516
ord595
ord631
ord632
EVENT_SINK_AddRef
DllFunctionCall
EVENT_SINK_Release
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord608
ord717
ProcCallEngine
ord644
ord570
ord100
ord616

Sections

.text
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ