29980a7472b32cf8b3720f47a76e17f2_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

29980a7472b32cf8b3720f47a76e17f2_JaffaCakes118
Size

60KB
MD5

29980a7472b32cf8b3720f47a76e17f2
SHA1

e5abe5fd831edcb7bad7d2e86ca49274fac7a440
SHA256

aa98b1623dfc808c9c42bd8f401e64ae6c543221de01023b5d8edad6ac4c2991
SHA512

61cf8c32f994d91153b40232069f98c33a248b2796c28c26dda3093a30d7a027d31c333bc499e433d36e9e257ff9c790572da92f408867547c51ef8e03bfeff2
SSDEEP

1536:eLdoFCNGhQkIwLgpbDNKKnD83MNHOYbANp:hCNGmkIwLgpbDLngoHOYo

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
29980a7472b32cf8b3720f47a76e17f2_JaffaCakes118

Files

29980a7472b32cf8b3720f47a76e17f2_JaffaCakes118
.exe windows:4 windows x86 arch:x86

645084b820af3a7705ddea06c681fe85

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

MethCallEngine
ord516
ord593
ord300
ord594
ord595
ord304
ord598
ord599
ord306
ord632
EVENT_SINK_AddRef
DllFunctionCall
EVENT_SINK_Release
ord600
ord310
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord312
ord606
ord716
ProcCallEngine
ord645
ord647
ord571
ord573
ord100
ord612
ord617
ord650
ord543
ord544
ord546

Sections

.text
Size: 52KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ