89598b118a8ad835636be14235c513c4_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

89598b118a8ad835636be14235c513c4_JaffaCakes118
Size

436KB
MD5

89598b118a8ad835636be14235c513c4
SHA1

7e03e6b9e1438906ba8b16c67d6c9b84b9c2682e
SHA256

99707047375c39dde122000cf753b77f7e5798da5a7ffc4a54e4110967ed1174
SHA512

d85dbe761569bdf7899dfd015f1cba1516598773e9bd42f74e70c3b3b9dd2e99f7d7d8435a30a660470fa8cc10f0bd0f801a422352208c266dacaae4c8ceb6e3
SSDEEP

12288:WkRuCBSfgth6pKeuyC4uiyLdp2Ssz0n3:ofWauyCF1Ga

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
89598b118a8ad835636be14235c513c4_JaffaCakes118

Files

89598b118a8ad835636be14235c513c4_JaffaCakes118
.exe windows:4 windows x86 arch:x86

fdb24aed00ebef665452b2ed1dac5b6d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetConsoleCP
GetSystemWindowsDirectoryW
Module32Next
GetCommandLineA
GetCommandLineW
lstrcpynA
ExitProcess
ExpandEnvironmentStringsW
VirtualAlloc
TransmitCommChar
GetCurrencyFormatA

msvbvm60

__vbaInStrVar
__vbaNew2
_adj_fprem1
ord307
__vbaOnError
ord689
__vbaVarDup
__vbaFpR8
__vbaStrToAnsi
__vbaRecUniToAnsi
ord105
__vbaAryVar
ord591
__vbaObjIs
ord303
__vbaGenerateBoundsError
__vbaStrTextCmp
__vbaStrCopy

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.textbs
Size: 5KB - Virtual size: 115KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.orpc
Size: 321KB - Virtual size: 545KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 98KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ