3eb5caadf7100711ec5bd39b2620d963_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3eb5caadf7100711ec5bd39b2620d963_JaffaCakes118
Size

65KB
MD5

3eb5caadf7100711ec5bd39b2620d963
SHA1

b38bbb6e897da3f23e24801330ea1c9baa17faa5
SHA256

ae53983d3973056575fa6344f1bf8ba1e7596f4d3a32dcf99fd72383326b08fc
SHA512

b94b5bb562c8d2f11c32cae1423f1b22785c17de65469c5ad7be70050e7782b39a7488136d6cbb690e76685e55a94004921618150d4f2898f13f92f9e9b36bc4
SSDEEP

1536:LbZCGCEPuzd18EmD/yEiUqiBYi2/Fm81u+O:LNCAPuaUiBYiKmuu+O

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3eb5caadf7100711ec5bd39b2620d963_JaffaCakes118

Files

3eb5caadf7100711ec5bd39b2620d963_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f4b86dbcac8ec462897fc2e160b91884

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

RtlMoveMemory

oleaut32

SysAllocStringLen

msvbvm60

MethCallEngine
ord516
ord669
ord595
ord598
ord631
ord632
EVENT_SINK_AddRef
DllFunctionCall
EVENT_SINK_Release
ord600
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord607
ord608
ProcCallEngine
ord535
ord537
ord644
ord645
ord648
ord573
ord681
ord578
ord100
ord617
ord619

Sections

.text
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ