a6a70abc9e147b86d9f736f7e953c8a7_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a6a70abc9e147b86d9f736f7e953c8a7_JaffaCakes118
Size

170KB
MD5

a6a70abc9e147b86d9f736f7e953c8a7
SHA1

2d76bdd658cf860a3e00a95ae3c96a5b4a1699f9
SHA256

3ec895b8d02ae683189906ae6e87c5fa2ac601fe14b439ef64e61f19b0af2535
SHA512

c4fe19a5239d78d27cd01016bde57e5056ef053d754fd64fd304e6222e359b02e7d0bbf645d3c2e5b5c411772e13ad550a8e88c0513fb0a12109b8040f0e2d10
SSDEEP

3072:7cUcm0X3qDOUwUNvo8Hj/64qDuibRF+phTjJfscbHALZt3HIN:7cUK3qDpvTT6LDuibf+phTjJEgAuN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a6a70abc9e147b86d9f736f7e953c8a7_JaffaCakes118

Files

a6a70abc9e147b86d9f736f7e953c8a7_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f2ba1e6021ee51caa7059c5e0d62d110

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

RtlMoveMemory

msvbvm60

MethCallEngine
ord516
ord598
ord632
EVENT_SINK_AddRef
DllFunctionCall
EVENT_SINK_Release
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord607
ord608
ProcCallEngine
ord644
ord100
ord617

Sections

.text
Size: 72KB - Virtual size: 69KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 94KB - Virtual size: 96KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE