Static task
static1
Behavioral task
behavioral1
Sample
ArcelorMittal Trading - ARMT#4562198.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
ArcelorMittal Trading - ARMT#4562198.exe
Resource
win10v2004-20240802-en
General
-
Target
c9588e5d9db72f846f40635fc3b7bd9e_JaffaCakes118
-
Size
30KB
-
MD5
c9588e5d9db72f846f40635fc3b7bd9e
-
SHA1
23912578ee29ce30e6fe54a8a5945d2fbdca3e1f
-
SHA256
09631538f6dad33f7a400df7e0338b117c36031df2019576c314ee3e57e5b42f
-
SHA512
bbefc2964e449b4c97075b0cc9e2ca9a8fc0e53b2179dd5d7b1960c68039a266b34ea2ba0ba458682657a7ad9e18764086781195ef75043ca78b05e617fa882b
-
SSDEEP
768:UZS1JBnLLI3DleMkV+U42yrZh343cW+XdQYbRlpjdU:UZoJ90TDkH4lrZhdW+NzA
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/ArcelorMittal Trading - ARMT#4562198.exe
Files
-
c9588e5d9db72f846f40635fc3b7bd9e_JaffaCakes118.rar
-
ArcelorMittal Trading - ARMT#4562198.exe.exe windows:4 windows x86 arch:x86
a519de1572f2db086b0735716b806d64
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
MethCallEngine
ord519
ord667
ord591
EVENT_SINK_AddRef
ord671
ord675
EVENT_SINK_Release
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord713
ord714
ProcCallEngine
ord538
ord574
ord100
Sections
.text Size: 112KB - Virtual size: 109KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ