858e60b8c9652ff2d2c210e2bff5ae69_JaffaCakes118

General

Target
858e60b8c9652ff2d2c210e2bff5ae69_JaffaCakes118
Size 280KB
Sample240810-k9drvsxgpb
SHA256 ab3ce1320ea93b8d76bf4276c5203263b8d4cd97f7aecd2c5208536f3b573a46
MD5 858e60b8c9652ff2d2c210e2bff5ae69
SHA1 d4bb59aa27cdef67f4e9be9946cd19dba2b16c30
SHA512 ba54952542c661b594286f0bd5a17e12f3e6f244dd005572eec8088a7620b4063886f33cfe59127d277ab9f3660968f231941eaabb0a19229e8af8e01724ed72
SSDEEP 6144:KISIpydVsZyxyK5R8GYKi1Xfvs1tzH51t+ewSReXNL/B:AuydfiebOTB
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
858e60b8c9652ff2d2c210e2bff5ae69_JaffaCakes118

File Explorer

858e60b8c9652ff2d2c210e2bff5ae69_JaffaCakes118

.exe 280KB

858e60b8c9652ff2d2c210e2bff5ae69_JaffaCakes118

IMPHASH ef04e16287aaf1358249329fa0734d8b
SHA256 ab3ce1320ea93b8d76bf4276c5203263b8d4cd97f7aecd2c5208536f3b573a46
MD5 858e60b8c9652ff2d2c210e2bff5ae69
SHA1 d4bb59aa27cdef67f4e9be9946cd19dba2b16c30
SHA512 ba54952542c661b594286f0bd5a17e12f3e6f244dd005572eec8088a7620b4063886f33cfe59127d277ab9f3660968f231941eaabb0a19229e8af8e01724ed72
SSDEEP 6144:KISIpydVsZyxyK5R8GYKi1Xfvs1tzH51t+ewSReXNL/B:AuydfiebOTB
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

17076

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

RtlMoveMemory

msvbvm60

EVENT_SINK_GetIDsOfNames __vbaVarSub __vbaVarTstGt __vbaStrI2 _CIcos _adj_fptan __vbaVarMove __vbaStrI4 __vbaVarVargNofree ord187 __vbaFreeVar __vbaAryMove __vbaStrVarMove __vbaLenBstr __vbaFreeVarList __vbaPut3 __vbaEnd _adj_fdiv_m64 __vbaPut4 EVENT_SINK_Invoke __vbaRaiseEvent __vbaFreeObjList ord516 __vbaStrErrVarCopy _adj_fprem1 __vbaRecAnsiToUni ord518 __vbaStrCat __vbaLsetFixstr __vbaSetSystemError __vbaRecDestruct __vbaHresultCheckObj __vbaLenBstrB _adj_fdiv_m32 __vbaAryVar Zombie_GetTypeInfo __vbaAryDestruct __vbaVarIndexLoadRefLock ord669 __vbaExitProc __vbaObjSet __vbaOnError _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i __vbaVarIndexLoad __vbaStrFixstr ord520 __vbaBoolVarNull __vbaFpR8 _CIsin ord631 ord709 __vbaErase __vbaVargVarMove __vbaVarZero ord632 __vbaChkstk __vbaFileClose ord526 EVENT_SINK_AddRef __vbaGenerateBoundsError ord528 __vbaGet3 __vbaStrCmp __vbaAryConstruct2 __vbaPutOwner3 __vbaVarTstEq __vbaI2I4 DllFunctionCall __vbaVarLateMemSt __vbaVarOr __vbaLbound __vbaRedimPreserve _adj_fpatan __vbaFixstrConstruct __vbaLateIdCallLd Zombie_GetTypeInfoCount __vbaRedim __vbaRecUniToAnsi EVENT_SINK_Release __vbaNew __vbaUI1I2 _CIsqrt EVENT_SINK_QueryInterface __vbaStr2Vec __vbaVarMul __vbaFpCmpCy __vbaExceptHandler ord711 __vbaStrToUnicode ord712 ord606 _adj_fprem _adj_fdivr_m64 ord607 ord608 __vbaFPException ord717 __vbaInStrVar ord319 __vbaStrVarVal __vbaUbound __vbaGetOwner4 __vbaVarCat ord535 __vbaI2Var ord537 ord644 ord645 _CIlog __vbaErrorOverflow __vbaFileOpen __vbaInStr __vbaNew2 ord648 __vbaVar2Vec __vbaVarInt _adj_fdiv_m32i _adj_fdivr_m32i __vbaStrCopy ord681 __vbaVarNot __vbaFreeStrList _adj_fdivr_m32 __vbaPowerR8 _adj_fdiv_r ord685 ord578 ord100 __vbaVarTstNe __vbaI4Var __vbaAryLock __vbaVarAdd ord320 __vbaStrComp __vbaStrToAnsi __vbaVarDup ord321 __vbaFpI2 ord616 __vbaFpI4 __vbaVarCopy ord617 _CIatan __vbaCastObj __vbaStrMove __vbaAryCopy __vbaStrVarCopy ord619 _allmul _CItan __vbaAryUnlock _CIexp __vbaFreeStr __vbaFreeObj __vbaI4ErrVar

Sharing

General

Malware Config

Signatures

File Explorer

858e60b8c9652ff2d2c210e2bff5ae69_JaffaCakes118

kernel32

msvbvm60

generic