4839a60c7038ba8a3df23995514ccf18_JaffaCakes118

General

Target
4839a60c7038ba8a3df23995514ccf18_JaffaCakes118
Size 288KB
Sample240715-e3s1ba1bjh
SHA256 3308ea4df1eda5afde4c5a2c015e1cfe3952690d38243ed5a6e8052af98cb958
MD5 4839a60c7038ba8a3df23995514ccf18
SHA1 a391eedf78aeb3da3fdb933f76e53d50f74d0c29
SHA512 5920ab0509b0c73085e0210cb4d4d0bb0bbb89949ddce1f9fdd831437b0f327e9376d12528fd709af987377a4b3b0f1ebabd3dea4af22edfe4e8b059c5150eac
SSDEEP 3072:8aSRhCqhfMeYVisu7vVOYT4m/xVhaIlfd6ZO0o/KjUQUrzq9KjKT:8phCym9u7UuVQI36LoCjU7zqEO
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4839a60c7038ba8a3df23995514ccf18_JaffaCakes118

File Explorer

4839a60c7038ba8a3df23995514ccf18_JaffaCakes118

.exe 288KB

4839a60c7038ba8a3df23995514ccf18_JaffaCakes118

IMPHASH b8e7db2b063920a9899d97fbf27958f2
SHA256 3308ea4df1eda5afde4c5a2c015e1cfe3952690d38243ed5a6e8052af98cb958
MD5 4839a60c7038ba8a3df23995514ccf18
SHA1 a391eedf78aeb3da3fdb933f76e53d50f74d0c29
SHA512 5920ab0509b0c73085e0210cb4d4d0bb0bbb89949ddce1f9fdd831437b0f327e9376d12528fd709af987377a4b3b0f1ebabd3dea4af22edfe4e8b059c5150eac
SSDEEP 3072:8aSRhCqhfMeYVisu7vVOYT4m/xVhaIlfd6ZO0o/KjUQUrzq9KjKT:8phCym9u7UuVQI36LoCjU7zqEO
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5884

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

FindResourceW VirtualProtect LoadResource SizeofResource

winmm

mciSendCommandA

msvbvm60

__vbaStrI2 _CIcos _adj_fptan __vbaVarMove __vbaStrI4 ord587 __vbaFreeVar __vbaStrVarMove __vbaLateIdCall __vbaLenBstr __vbaFreeVarList _adj_fdiv_m64 __vbaRaiseEvent __vbaFreeObjList ord517 _adj_fprem1 __vbaStrCat __vbaSetSystemError __vbaHresultCheckObj _adj_fdiv_m32 __vbaAryVar __vbaAryDestruct __vbaExitProc __vbaObjSet __vbaOnError ord595 _adj_fdiv_m16i _adj_fdivr_m16i ord598 ord520 _CIsin ord525 ord632 __vbaChkstk EVENT_SINK_AddRef __vbaGenerateBoundsError __vbaStrCmp __vbaObjVar DllFunctionCall __vbaRedimPreserve _adj_fpatan __vbaLateIdCallLd __vbaStrR8 __vbaRedim EVENT_SINK_Release __vbaNew _CIsqrt EVENT_SINK_QueryInterface __vbaExceptHandler ord711 __vbaStrToUnicode ord606 _adj_fprem _adj_fdivr_m64 ord607 __vbaFPException __vbaUbound _CIlog __vbaInStr __vbaR8Str _adj_fdiv_m32i ord572 _adj_fdivr_m32i __vbaStrCopy __vbaI4Str __vbaFreeStrList _adj_fdivr_m32 _adj_fdiv_r ord685 ord100 __vbaI4Var __vbaAryLock __vbaStrToAnsi __vbaVarDup ord616 __vbaVarCopy ord617 _CIatan __vbaStrMove __vbaAryCopy __vbaCastObj ord650 _allmul __vbaLateIdSt ord652 _CItan __vbaAryUnlock _CIexp __vbaFreeStr __vbaFreeObj

Sharing

General

Malware Config

Signatures

File Explorer

4839a60c7038ba8a3df23995514ccf18_JaffaCakes118

kernel32

winmm

msvbvm60

generic