11ec632357114144993558e161b5bbf0_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

11ec632357114144993558e161b5bbf0_JaffaCakes118
Size

162KB
MD5

11ec632357114144993558e161b5bbf0
SHA1

c8f8ac25116cd1867ec83d143597824ba59492a8
SHA256

4483ae197849200714c7c67c17855517b4589a8be34563429f3cbd41cbef4f09
SHA512

4b230389dcc756370356baf483358d2a0ad46b88aeae7d26d1bb0f5f245e4d06dfb2413f46886b1419f85614bd63ffd19ecc4874f8dad95780b2060139e85878
SSDEEP

3072:4bfLQKZ2tginU8NCs/PDi3UTQQey4W1aLqvmEfNyHugdmT/XYUVD:43YbCs/W3Uk018qvmTH6rn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
11ec632357114144993558e161b5bbf0_JaffaCakes118

Files

11ec632357114144993558e161b5bbf0_JaffaCakes118
.exe windows:4 windows x86 arch:x86

0b12ad32231b9bddbeb1abc0d228afc1

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

DeregisterEventSource

msvbvm60

ord183
ord553
ord668
ord594
ord598
ord522
EVENT_SINK_AddRef
DllFunctionCall
ord670
ord563
EVENT_SINK_Release
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord714
ord717
ProcCallEngine
ord537
ord644
ord570
ord100
ord615
ord432
ord547

Sections

.text
Size: 147KB - Virtual size: 147KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ