0f2f1483258524ce6e67c02aabb9d66a_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

0f2f1483258524ce6e67c02aabb9d66a_JaffaCakes118
Size

824KB
MD5

0f2f1483258524ce6e67c02aabb9d66a
SHA1

ce0515086b2d0323a016a801ae4537ccf9f3182c
SHA256

a278bde5dfcaa0e4a094dae9d33c012844e18dab6f3654aa5f2736810f6c07ea
SHA512

b15a11db6dab8ac3ad9336d910b2dfcf5edc6196a618ad62f3f5a5b8a80553221f5b6f727daafb9692444cdc74f6e4328e38cc8d354845207f2425b00f74f796
SSDEEP

24576:yxxxxxKGEjXq2JcwZ+Sv6KMHH4eFgpToIVxtH:bGIL5ptH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0f2f1483258524ce6e67c02aabb9d66a_JaffaCakes118

Files

0f2f1483258524ce6e67c02aabb9d66a_JaffaCakes118
.exe windows:4 windows x86 arch:x86

dbeb130885439bda1491c6a8a2ed42be

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

__vbaChkstk
__vbaExceptHandler
__vbaFPException
_adj_fdiv_m16i
_adj_fdiv_m32
_adj_fdiv_m32i
_adj_fdiv_m64
_adj_fdiv_r
_adj_fdivr_m16i
_adj_fdivr_m32
_adj_fdivr_m32i
_adj_fdivr_m64
_adj_fpatan
_adj_fprem
_adj_fprem1
_adj_fptan
_CIatan
_CIcos
_CIexp
_CIlog
_CIsin
_CIsqrt
_CItan
_allmul
DllFunctionCall
__vbaHresultCheckObj
__vbaSetSystemError
__vbaExitProc
__vbaVarCopy
__vbaVarForNext
rtcRightCharVar
rtcLeftCharVar
__vbaInStr
__vbaVarForInit
__vbaStrCopy
__vbaFreeObj
__vbaObjSetAddref
__vbaLenBstr
__vbaNew2
__vbaObjSet
__vbaFileClose
__vbaPrintFile
__vbaFileOpen
__vbaStrCmp
__vbaVarAdd
__vbaVarTstLe
__vbaFpI4
__vbaErrorOverflow
__vbaI2I4
__vbaOnError
__vbaR8IntI4
rtcVarBstrFromAnsi
__vbaVarCat
__vbaStrVarMove
__vbaStrMove
__vbaFreeVar
__vbaFreeVarList
rtcDoEvents
__vbaFreeStr
__vbaVarVargNofree
__vbaStrVarVal
rtcR8ValFromBstr
__vbaVarSub
__vbaVarTstLt
rtcGetTimer
__vbaVarMove
__vbaI4Str
__vbaStrToUnicode
__vbaAryUnlock
__vbaAryLock
__vbaStrToAnsi
__vbaUI1I4
__vbaRedim
__vbaAryDestruct
__vbaLateIdCall
__vbaUI1I2
__vbaGenerateBoundsError
__vbaAryConstruct2
__vbaInStrVar
__vbaI2Var
__vbaVarTstEq
rtcTrimVar
rtcMidCharVar
__vbaStrCat
rtcLeftCharBstr
__vbaFreeStrList
__vbaVarDup
rtcStringVar
rtcAnsiValueBstr
__vbaI4Var
rtcReplace
rtcMidCharBstr
__vbaEnd
__vbaVarLateMemCallLd
rtcSaveSetting
rtcGetSetting
__vbaStrR8
__vbaStrI4
rtcInputBox
rtcMsgBox
__vbaR8Str
__vbaI2Str
__vbaStrI2
__vbaVarIndexLoad
rtcSplit
__vbaInputFile
rtcEndOfFile
rtcFreeFile
__vbaCastObj
__vbaLateIdSt
__vbaFreeObjList
__vbaLateIdCallLd
__vbaCastObjVar
__vbaAryVar
__vbaAryCopy
__vbaObjVar
__vbaLateMemCall
__vbaVarCmpEq
__vbaVarOr
__vbaBoolVarNull
rtcLowerCaseVar
__vbaRaiseEvent
__vbaNextEachCollObj
__vbaForEachCollObj
rtcBstrFromAnsi
rtcStringBstr
rtcInStrRev
__vbaUbound
__vbaGet3
rtcFileLength
rtcSpaceBstr
__vbaRefVarAry
__vbaStrVarCopy
rtcRound
__vbaFPInt
__vbaStrR4
rtcRandomNext
rtcShell
EVENT_SINK_QueryInterface
EVENT_SINK_AddRef
EVENT_SINK_Release
ThunRTMain

Sections

.text
Size: 592KB - Virtual size: 592KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.oldxlok
Size: 184KB - Virtual size: 184KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.imports
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE

Sharing

General

Malware Config

Signatures

Files

dbeb130885439bda1491c6a8a2ed42be

Headers

File Characteristics

Imports

msvbvm60

Sections

.text Size: 592KB - Virtual size: 592KB

.data Size: 24KB - Virtual size: 24KB

.rsrc Size: 4KB - Virtual size: 4KB

.oldxlok Size: 184KB - Virtual size: 184KB

.imports Size: 16KB - Virtual size: 16KB

.text
Size: 592KB - Virtual size: 592KB

.data
Size: 24KB - Virtual size: 24KB

.rsrc
Size: 4KB - Virtual size: 4KB

.oldxlok
Size: 184KB - Virtual size: 184KB

.imports
Size: 16KB - Virtual size: 16KB