a2982d6058deca01c0a101649934d379_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a2982d6058deca01c0a101649934d379_JaffaCakes118
Size

136KB
MD5

a2982d6058deca01c0a101649934d379
SHA1

d5e9c7ef77744dba3e863b6a4e74e7c92983d14e
SHA256

451f203f0a8a42858b7e850d495c04190c3c7acf7150b27b07e4dbdbcf15921c
SHA512

c76919dbec47aaedb948fc283fb366aaffbfde4124bb0fa202faa7510171c649d4e0e1d7b6b4c922f0bcde541aad4052a3cc4cca6c6e64efc5c33d80bf4e5ba9
SSDEEP

3072:HVjpVI2nsBAEcmWOSWvIVLozHVYuhf8tR4OVumkn:bXq0unn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a2982d6058deca01c0a101649934d379_JaffaCakes118

Files

a2982d6058deca01c0a101649934d379_JaffaCakes118
.exe windows:4 windows x86 arch:x86

e67757e31b92f20555578c0ccf3464d9

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryW

msvbvm60

ord696
ord516
ord519
ord666
ord667
ord593
ord594
ord595
ord598
ord709
ord631
ord632
ord526
EVENT_SINK_AddRef
DllFunctionCall
EVENT_SINK_Release
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord712
ord531
ord716
ord717
ProcCallEngine
ord535
ord644
ord681
ord576
ord685
ord100
ord616
ord618
ord580

Sections

.text
Size: 84KB - Virtual size: 81KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 19KB - Virtual size: 20KB