417fb9703853850b3d4b979b597b01e3_JaffaCakes118 | Triage

Sharing

General

Target

417fb9703853850b3d4b979b597b01e3_JaffaCakes118
Size

318KB
MD5

417fb9703853850b3d4b979b597b01e3
SHA1

962ad7d72d492a30fb89b9c70820abc684a523b7
SHA256

e3ae00173a66ba93a6e9afbaf7395116d55fe3d68a8cf2141a03f70acbc38a27
SHA512

fb8f3fec41e311a392db7ae9e69c4aff6259c0422422eb69a07d18f9a481444173ff118729b843258962e807e0572fafe8c2c77e0f9c70527f4875b5864d0093
SSDEEP

6144:V7aHPl2nXPnnPpvRtt+nDf9eCTPONc80gYk+rB9xoaAo/0Cd/yLQ:V7ql2/xZADfPTPONDrYkEPtAIdaE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
417fb9703853850b3d4b979b597b01e3_JaffaCakes118

Files

417fb9703853850b3d4b979b597b01e3_JaffaCakes118
.exe windows:4 windows x86 arch:x86

9fd48f106e63d327096f4422c4480966

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadResource
LoadLibraryA
LockResource
ExitProcess

msvbvm60

ord696
ord698
MethCallEngine
ord632
ord525
EVENT_SINK_AddRef
DllFunctionCall
EVENT_SINK_Release
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord712
ord608
ord717
ProcCallEngine
ord537
ord644
ord100

Sections

.text
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 292KB - Virtual size: 292KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ