42e14c229e7caf72936ebac56c7b9164_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

42e14c229e7caf72936ebac56c7b9164_JaffaCakes118
Size

117KB
MD5

42e14c229e7caf72936ebac56c7b9164
SHA1

355cbbffdf22a0b7eaeef818580a8bfd0be989b8
SHA256

12d8f1238008e4209664bcaa18a300f869cc20f2330e1f30f114002ab427e31d
SHA512

0c89ff715d1e537a035e730a6f4c963be015a0dfc6ae4611f8615b0ab0a1793d562fab2eee4d18f8d73028344f6929ed917ba1973b17891acacd034535ac6a54
SSDEEP

3072:XSuRB3hCtefXInkm0kaLLcKn9OS0qvaDQQp:CuRBRx/Ikfk8/0eKQQp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
42e14c229e7caf72936ebac56c7b9164_JaffaCakes118

Files

42e14c229e7caf72936ebac56c7b9164_JaffaCakes118
.exe windows:4 windows x86 arch:x86

9cbcd5342d963a0926451e8738ced02a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

ShowWindow
CallWindowProcA

kernel32

GetProcAddress
SizeofResource
LoadLibraryA
LockResource
ExitProcess

msvbvm60

MethCallEngine
ord516
ord631
ord526
EVENT_SINK_AddRef
DllFunctionCall
EVENT_SINK_Release
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord717
ProcCallEngine
ord644
ord100

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 106KB - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ