9f815837d6d40b1bbb99150b2eb8a23d_JaffaCakes118

General

Target
9f815837d6d40b1bbb99150b2eb8a23d_JaffaCakes118
Size 501KB
Sample240816-xdrp3azgrf
SHA256 03a5fa1364812aca21355219a53a296b751c01646df8122ce0f4352368756145
MD5 9f815837d6d40b1bbb99150b2eb8a23d
SHA1 1ff2505316c884e77c23afe2a136bbead7e1f87e
SHA512 f1e0799d7c5d28d584ca729b23f982f1b344ad24209cda7c29c0112c8eec59f324218a5b8bd952231ebd300c736f06bb8ce2fa3b46bfddc966ad74ed32e853ce
SSDEEP 12288:DyNLsc3uWFLHAAcIjyVhINmm4R3+RPTaFzVLFatYbC4Ao:YLsc3uWFLHxchINm1N+9a/paaEo
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9f815837d6d40b1bbb99150b2eb8a23d_JaffaCakes118

File Explorer

9f815837d6d40b1bbb99150b2eb8a23d_JaffaCakes118

.exe 501KB

9f815837d6d40b1bbb99150b2eb8a23d_JaffaCakes118

IMPHASH 4db008398fb22d7e16b084cd8c75e1b4
SHA256 03a5fa1364812aca21355219a53a296b751c01646df8122ce0f4352368756145
MD5 9f815837d6d40b1bbb99150b2eb8a23d
SHA1 1ff2505316c884e77c23afe2a136bbead7e1f87e
SHA512 f1e0799d7c5d28d584ca729b23f982f1b344ad24209cda7c29c0112c8eec59f324218a5b8bd952231ebd300c736f06bb8ce2fa3b46bfddc966ad74ed32e853ce
SSDEEP 12288:DyNLsc3uWFLHAAcIjyVhINmm4R3+RPTaFzVLFatYbC4Ao:YLsc3uWFLHxchINm1N+9a/paaEo
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

6064

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

_CIcos _adj_fptan __vbaStrI4 __vbaVarMove __vbaVarVargNofree __vbaAryMove __vbaFreeVar __vbaGosubReturn __vbaStrVarMove __vbaLenBstr __vbaEnd __vbaFreeVarList _adj_fdiv_m64 __vbaFreeObjList _adj_fprem1 __vbaStrCat __vbaLsetFixstr __vbaSetSystemError __vbaHresultCheckObj _adj_fdiv_m32 __vbaAryDestruct ord595 __vbaObjSet __vbaOnError _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i ord598 __vbaCyStr __vbaRefVarAry _CIsin __vbaErase ord631 ord525 __vbaVarZero __vbaChkstk __vbaGosubFree ord526 __vbaFileClose EVENT_SINK_AddRef __vbaGenerateBoundsError __vbaStrCmp __vbaGet3 __vbaAryConstruct2 __vbaI2I4 ord561 DllFunctionCall __vbaCastObjVar __vbaRedimPreserve _adj_fpatan __vbaFixstrConstruct __vbaLateIdCallLd __vbaRedim EVENT_SINK_Release __vbaNew __vbaUI1I2 _CIsqrt EVENT_SINK_QueryInterface __vbaUI1I4 __vbaExceptHandler __vbaStrToUnicode ord712 _adj_fprem _adj_fdivr_m64 __vbaLateIdStAd __vbaGosub ord607 __vbaFPException ord717 __vbaStrVarVal __vbaUbound __vbaVarCat __vbaLsetFixstrFree ord537 ord644 _CIlog __vbaErrorOverflow __vbaFileOpen ord570 __vbaNew2 __vbaVar2Vec __vbaInStr _adj_fdiv_m32i _adj_fdivr_m32i ord573 __vbaStrCopy __vbaI4Str ord681 __vbaFreeStrList _adj_fdivr_m32 _adj_fdiv_r ord685 ord100 __vbaVarTstNe __vbaI4Var __vbaAryLock __vbaVarDup __vbaStrToAnsi __vbaVerifyVarObj ord616 __vbaFpI4 __vbaVarCopy _CIatan __vbaCastObj ord618 __vbaUI1Str __vbaStrMove __vbaAryCopy __vbaStrVarCopy _allmul _CItan __vbaUI1Var __vbaAryUnlock _CIexp __vbaFreeStr __vbaFreeObj ord581

Name

.text

Size

76KB

Virtual Size

74KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

104KB

Virtual Size

103KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.

Size

4KB

Virtual Size

4KB

Characteristics

Name

.

Size

4KB

Virtual Size

4KB

Characteristics

Name

.

Size

4KB

Virtual Size

4KB

Characteristics

Sharing

General

Malware Config

Signatures

File Explorer

9f815837d6d40b1bbb99150b2eb8a23d_JaffaCakes118

msvbvm60

generic