268736846f90cba7215183ee3a2896db_JaffaCakes118

Sharing

Copy URL Twitter E-mail

Reason

config extraction: GuloaderBin: guloader: invalid shellcode

General

Target

268736846f90cba7215183ee3a2896db_JaffaCakes118
Size

946KB
MD5

268736846f90cba7215183ee3a2896db
SHA1

bd05329e99e33a411620040381a7238db03c98b0
SHA256

a09c21837fb2bc778c02a0547472e486bca2beb8f0e7e130c9fcb41311635aa6
SHA512

fea3d8a02b5d9cd2238da3140dfbe377a5cb8afd6e1884d022764098742dbd7c96cfe25dcce78be7a01da1875a219f2acff18fff4e2f683cbcdfaec5101f2d4a
SSDEEP

12288:7dc8DS1/A7jX56Ghr1+3m/cgvcrPGnUzM0MhXGP8E49ZgNATgi3D7Z9/IAeQLeQT:76adL5+36cPGUI0fP8N7gqTH/YPj8

Score

1^/10

Malware Config

Signatures

Files

268736846f90cba7215183ee3a2896db_JaffaCakes118
.exe windows:4 windows x86 arch:x86

cb4b37aab4121fae0db7cd695568be25

Code Sign

01
Certificate

Issuer

CN=Expert Booking Client 2015 ©,O=Explorer Software © 2009-2018 All rights reserved Inc.,C=LI

Not Before

08/11/2018, 09:14

Not After

07/11/2021, 09:14

Subject

CN=Expert Booking Client 2015 ©,O=Explorer Software © 2009-2018 All rights reserved Inc.,C=LI

5d:e3:5c:eb:eb:9d:90:9d:8c:a2:45:ae:7c:bd:07:da:2f:6f:30:42
Signer

Actual PE Digest

5d:e3:5c:eb:eb:9d:90:9d:8c:a2:45:ae:7c:bd:07:da:2f:6f:30:42

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

ord582
__vbaVarTstGt
__vbaVarSub
_CIcos
_adj_fptan
__vbaVarMove
ord693
__vbaFreeVar
__vbaFreeVarList
_adj_fdiv_m64
_adj_fprem1
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryDestruct
__vbaVarForInit
__vbaObjSet
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
ord598
__vbaFpR8
_CIsin
__vbaChkstk
__vbaFileClose
EVENT_SINK_AddRef
__vbaStrCmp
__vbaVarTstEq
__vbaAryConstruct2
DllFunctionCall
_adj_fpatan
__vbaLateIdCallLd
EVENT_SINK_Release
__vbaUI1I2
_CIsqrt
EVENT_SINK_QueryInterface
__vbaVarMul
__vbaExceptHandler
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
__vbaFPException
__vbaGetOwner3
_CIlog
__vbaErrorOverflow
__vbaNew2
__vbaR8Str
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
_adj_fdivr_m32
_adj_fdiv_r
ord685
ord100
__vbaI4Var
__vbaVarAdd
__vbaStrToAnsi
_CIatan
__vbaStrMove
ord618
_allmul
_CItan
__vbaVarForNext
_CIexp
__vbaFreeObj
__vbaFreeStr

Sections

.text
Size: 912KB - Virtual size: 909KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

Errors

General

Malware Config

Signatures

Files

cb4b37aab4121fae0db7cd695568be25

Code Sign

01Certificate

5d:e3:5c:eb:eb:9d:90:9d:8c:a2:45:ae:7c:bd:07:da:2f:6f:30:42Signer

Headers

File Characteristics

Imports

msvbvm60

Sections

.text Size: 912KB - Virtual size: 909KB

.data Size: 4KB - Virtual size: 2KB

.rsrc Size: 24KB - Virtual size: 23KB

01
Certificate

5d:e3:5c:eb:eb:9d:90:9d:8c:a2:45:ae:7c:bd:07:da:2f:6f:30:42
Signer

.text
Size: 912KB - Virtual size: 909KB

.data
Size: 4KB - Virtual size: 2KB

.rsrc
Size: 24KB - Virtual size: 23KB