darkcomet | 477fbd616d516db1bb40e0ff492b1085_JaffaCakes118

General

Target
477fbd616d516db1bb40e0ff492b1085_JaffaCakes118
Size 1.2MB
Sample240715-a4kywasfpg
SHA256 f03f9f345d95a329af70d15b5f15fb2c70099553c7940232e0199efc77eb0837
MD5 477fbd616d516db1bb40e0ff492b1085
SHA1 967ea8626d32209b3d0f069ed14abeed3b44d9c5
SHA512 03146aa9f714432bbb6eefaa716bb69df44ed3eeb666cfd81c50e5deba982ae6dcfc431ff3705c522f05aef9156a1d1d17756c55a7f115196bcb6101019539d3
SSDEEP 24576:aMnVDM2MmioPaGX0QRWoJEfg0oChGdJQbjPbNW5tYeP+Gc7PaGB:znVAHmiuaLQRV2o3MPY5ABao
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darkcomet

Malware Config

Signatures

Darkcomet family
darkcomet

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
477fbd616d516db1bb40e0ff492b1085_JaffaCakes118

File Explorer

477fbd616d516db1bb40e0ff492b1085_JaffaCakes118

.exe 1.2MB

477fbd616d516db1bb40e0ff492b1085_JaffaCakes118

IMPHASH 16c542ddd0610c62f151aa4a00911d2f
SHA256 f03f9f345d95a329af70d15b5f15fb2c70099553c7940232e0199efc77eb0837
MD5 477fbd616d516db1bb40e0ff492b1085
SHA1 967ea8626d32209b3d0f069ed14abeed3b44d9c5
SHA512 03146aa9f714432bbb6eefaa716bb69df44ed3eeb666cfd81c50e5deba982ae6dcfc431ff3705c522f05aef9156a1d1d17756c55a7f115196bcb6101019539d3
SSDEEP 24576:aMnVDM2MmioPaGX0QRWoJEfg0oChGdJQbjPbNW5tYeP+Gc7PaGB:znVAHmiuaLQRV2o3MPY5ABao
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4832

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

__vbaVarTstGt __vbaVarSub __vbaStrI2 _CIcos _adj_fptan __vbaStrI4 __vbaVarMove __vbaVarVargNofree __vbaAryMove __vbaFreeVar ord588 __vbaLineInputStr __vbaStrVarMove __vbaLenBstr ord697 __vbaFreeVarList _adj_fdiv_m64 __vbaNextEachVar __vbaRaiseEvent __vbaFreeObjList ord516 _adj_fprem1 __vbaRecAnsiToUni ord519 __vbaResume __vbaCopyBytes __vbaStrCat __vbaVarTextTstEq __vbaLsetFixstr __vbaSetSystemError __vbaHresultCheckObj __vbaLenVar _adj_fdiv_m32 __vbaAryVar __vbaAryDestruct __vbaLateMemSt ord592 __vbaVarForInit __vbaForEachCollObj __vbaExitProc ord595 __vbaObjSet __vbaOnError _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i __vbaVarIndexLoad ord598 __vbaStrFixstr ord520 __vbaBoolVar __vbaStrTextCmp ord523 __vbaVarTstLt __vbaBoolVarNull _CIsin ord631 ord709 __vbaErase ord525 ord632 __vbaVarZero __vbaNextEachCollObj __vbaChkstk ord526 __vbaFileClose EVENT_SINK_AddRef ord528 __vbaGenerateBoundsError __vbaGet3 __vbaAryConstruct2 __vbaVarTstEq __vbaObjVar DllFunctionCall __vbaVarOr __vbaVarLateMemSt __vbaCastObjVar __vbaRedimPreserve __vbaLbound _adj_fpatan __vbaR4Var __vbaLateIdCallLd __vbaRedim __vbaRecUniToAnsi __vbaUI1ErrVar EVENT_SINK_Release ord601 _CIsqrt __vbaObjIs __vbaVarAnd EVENT_SINK_QueryInterface __vbaVarMul __vbaVarTextCmpEq __vbaExceptHandler ord711 __vbaPrintFile ord712 __vbaStrToUnicode ord606 ord713 _adj_fprem _adj_fdivr_m64 __vbaVarDiv ord607 __vbaI2Str ord530 ord608 ord531 __vbaFPException ord717 ord319 ord533 __vbaUbound __vbaStrVarVal __vbaVarCat __vbaCheckType __vbaI2Var ord537 ord644 ord645 _CIlog ord646 __vbaFileOpen ord648 __vbaInStr ord570 __vbaVar2Vec __vbaR8Str __vbaVarLateMemCallLdRf __vbaNew2 ord571 _adj_fdiv_m32i ord572 _adj_fdivr_m32i __vbaStrCopy __vbaI4Str ord681 __vbaFreeStrList _adj_fdivr_m32 __vbaPowerR8 _adj_fdiv_r ord685 ord100 __vbaI4Var __vbaVarCmpEq __vbaAryLock __vbaLateMemCall __vbaVarAdd ord320 __vbaVarDup __vbaStrToAnsi ord321 __vbaFpI2 __vbaVarMod ord616 __vbaVarCopy __vbaFpI4 __vbaVarLateMemCallLd ord617 __vbaLateMemCallLd _CIatan __vbaI2ErrVar ord618 __vbaAryCopy __vbaCastObj __vbaStrMove ord619 __vbaStrVarCopy __vbaForEachVar ord650 _allmul __vbaLateIdSt ord651 __vbaVarTextCmpNe _CItan __vbaUI1Var __vbaAryUnlock __vbaVarForNext _CIexp __vbaI4ErrVar __vbaFreeObj __vbaFreeStr ord581

Sharing