c376bf2085e4a128138f9670a00238df_JaffaCakes118

General

Target
c376bf2085e4a128138f9670a00238df_JaffaCakes118
Size 348KB
Sample240826-vrz79avhpc
SHA256 49b88c44acd0ac95bdf30f02c4692e4e46010363fb5609278837a998819c02f4
MD5 c376bf2085e4a128138f9670a00238df
SHA1 a07d8e9154ab987d6ec086fe1998e765acca2e08
SHA512 2483fab364e3d0f0df484dba14f7af75c3b429de168a835a7f75d0c41482accac8dd014b5901960ab39b5890bd359ac6fd9ae2d2bc2855fe1923bce56451745d
SSDEEP 3072:iBVIprHpt3UJUx8J8BlA4wgfrgT5iH0OBZgD+GkG8sp40aHP00Wm6E6lW7mf2gq+:iBqZzx8GXfETq3Bxesci6OjgqlQex8
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c376bf2085e4a128138f9670a00238df_JaffaCakes118

File Explorer

c376bf2085e4a128138f9670a00238df_JaffaCakes118

.exe 348KB

c376bf2085e4a128138f9670a00238df_JaffaCakes118

IMPHASH f9f8ec9217668dd8d7ba1af44814d156
SHA256 49b88c44acd0ac95bdf30f02c4692e4e46010363fb5609278837a998819c02f4
MD5 c376bf2085e4a128138f9670a00238df
SHA1 a07d8e9154ab987d6ec086fe1998e765acca2e08
SHA512 2483fab364e3d0f0df484dba14f7af75c3b429de168a835a7f75d0c41482accac8dd014b5901960ab39b5890bd359ac6fd9ae2d2bc2855fe1923bce56451745d
SSDEEP 3072:iBVIprHpt3UJUx8J8BlA4wgfrgT5iH0OBZgD+GkG8sp40aHP00Wm6E6lW7mf2gq+:iBqZzx8GXfETq3Bxesci6OjgqlQex8
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10912

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

oleaut32

SysAllocStringByteLen

kernel32

IsBadCodePtr VirtualAlloc FindResourceW VirtualProtect GetStartupInfoW LoadResource SizeofResource GetProcessHeap LockResource HeapAlloc

msvbvm60

ord690 _CIcos _adj_fptan __vbaStrI4 __vbaVarMove __vbaAryMove __vbaFreeVar ord588 __vbaLenBstr __vbaLateIdCall __vbaStrVarMove __vbaFreeVarList _adj_fdiv_m64 __vbaRaiseEvent __vbaFreeObjList ord516 __vbaStrErrVarCopy _adj_fprem1 ord519 __vbaResume __vbaStrCat __vbaBoolErrVar __vbaSetSystemError __vbaLenBstrB __vbaHresultCheckObj _adj_fdiv_m32 __vbaAryVar __vbaAryDestruct ord591 __vbaVarForInit __vbaBoolStr __vbaStrBool __vbaExitProc ord301 __vbaObjSet __vbaOnError ord595 _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i ord598 __vbaBoolVar ord520 ord307 __vbaBoolVarNull _CIsin __vbaErase ord631 ord525 __vbaChkstk EVENT_SINK_AddRef ord527 __vbaStrCmp __vbaAryConstruct2 __vbaVarTstEq ord561 __vbaObjVar DllFunctionCall __vbaVarLateMemSt __vbaRedimPreserve __vbaLbound __vbaStrR4 _adj_fpatan __vbaLateIdCallLd __vbaRedim __vbaStrR8 EVENT_SINK_Release _CIsqrt __vbaObjIs __vbaLateIdCallSt EVENT_SINK_QueryInterface __vbaExceptHandler ord711 ord712 __vbaStrToUnicode _adj_fprem _adj_fdivr_m64 __vbaFPException ord717 ord319 __vbaUbound __vbaStrVarVal __vbaVarCat __vbaI2Var ord644 _CIlog __vbaVar2Vec __vbaVarLateMemCallLdRf __vbaInStr __vbaR8Str __vbaNew2 _adj_fdiv_m32i ord572 _adj_fdivr_m32i __vbaStrCopy ord681 __vbaVarNot __vbaFreeStrList _adj_fdivr_m32 _adj_fdiv_r ord685 ord100 __vbaVarSetVar __vbaI4Var __vbaVarLateMemStAd ord689 __vbaVarCmpEq ord610 __vbaAryLock __vbaLateMemCall __vbaVarAdd ord320 __vbaFreeVarg __vbaStrToAnsi __vbaStrComp __vbaVarDup ord321 __vbaFpI2 __vbaFpI4 ord616 __vbaVarLateMemCallLd __vbaLateMemCallLd _CIatan __vbaAryCopy __vbaStrMove __vbaCastObj __vbaStrVarCopy __vbaVarNeg ord650 _allmul __vbaVarLateMemCallSt __vbaLateIdSt _CItan __vbaAryUnlock __vbaVarForNext _CIexp __vbaI4ErrVar __vbaRecAssign __vbaFreeObj __vbaFreeStr ord581

Sharing

General

Malware Config

Signatures

File Explorer

c376bf2085e4a128138f9670a00238df_JaffaCakes118

oleaut32

kernel32

msvbvm60

generic