53a3aa4d768ff87c18ebd2263cb80d16_JaffaCakes118

Sharing

Copy URL Twitter E-mail

Reason

config extraction: GuloaderBin: guloader: invalid shellcode

General

Target

53a3aa4d768ff87c18ebd2263cb80d16_JaffaCakes118
Size

584KB
MD5

53a3aa4d768ff87c18ebd2263cb80d16
SHA1

525a64fbf4a6524e37e353c20349cf312f489640
SHA256

3426f8538d131b414fec5c0fe44141909f51e1215f62271cc17b3c0223e5d0bf
SHA512

b5558e95c25be0792b3fb6e12387c99c307266507d32e617252d2b65900f9d04671f1f88ff638edda2a25bdb953819f7f11d2616650bcb1de178369795a93734
SSDEEP

12288:qb2gNgLk131mHhyD0HrjETpc/C5ZTG3Bk98ea0y+iYqfyj7IgUzvbErTm3Oq3PgP:YOA19pcK5S5S

Score

1^/10

Malware Config

Signatures

Files

53a3aa4d768ff87c18ebd2263cb80d16_JaffaCakes118
.exe windows:4 windows x86 arch:x86

eb3beddcddcdfd63b30bc6c3384a3f5b

Code Sign

01
Certificate

Issuer

CN=Plugin Setup Build Number F5443 (32-bit),O=Setup Build Number F5443 (32-bit),C=TW

Not Before

19/11/2018, 13:42

Not After

18/11/2021, 13:42

Subject

CN=Plugin Setup Build Number F5443 (32-bit),O=Setup Build Number F5443 (32-bit),C=TW

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

96:4c:5b:a7:43:86:89:fc:39:95:f5:11:78:f6:17:e7:ab:54:7f:29:eb:fd:77:8a:e2:d4:a0:0b:d5:92:7c:c6
Signer

Actual PE Digest

96:4c:5b:a7:43:86:89:fc:39:95:f5:11:78:f6:17:e7:ab:54:7f:29:eb:fd:77:8a:e2:d4:a0:0b:d5:92:7c:c6

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

__vbaVarSub
__vbaStrI2
_CIcos
_adj_fptan
__vbaVarMove
ord693
__vbaFreeVar
__vbaStrVarMove
__vbaFreeVarList
_adj_fdiv_m64
_adj_fprem1
ord660
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryDestruct
__vbaOnError
ord595
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
ord521
__vbaFPFix
_CIsin
ord525
__vbaChkstk
EVENT_SINK_AddRef
__vbaStrCmp
__vbaAryConstruct2
__vbaVarTstEq
DllFunctionCall
ord673
_adj_fpatan
__vbaLateIdCallLd
EVENT_SINK_Release
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
ord607
ord608
__vbaFPException
__vbaInStrVar
ord645
_CIlog
__vbaErrorOverflow
__vbaNew2
ord571
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
ord574
_adj_fdivr_m32
_adj_fdiv_r
ord100
__vbaVarTstNe
__vbaI4Var
__vbaVarDup
__vbaStrToAnsi
__vbaFpI4
ord616
__vbaVarCopy
ord617
__vbaLateMemCallLd
_CIatan
__vbaStrMove
ord618
__vbaI4Cy
_allmul
__vbaFpCSngR4
_CItan
_CIexp
__vbaFreeObj
__vbaFreeStr

Sections

.text
Size: 560KB - Virtual size: 557KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

Errors

General

Malware Config

Signatures

Files

eb3beddcddcdfd63b30bc6c3384a3f5b

Code Sign

01Certificate

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77Certificate

Extended Key Usages

Key Usages

96:4c:5b:a7:43:86:89:fc:39:95:f5:11:78:f6:17:e7:ab:54:7f:29:eb:fd:77:8a:e2:d4:a0:0b:d5:92:7c:c6Signer

Headers

File Characteristics

Imports

msvbvm60

Sections

.text Size: 560KB - Virtual size: 557KB

.data Size: 4KB - Virtual size: 2KB

.rsrc Size: 12KB - Virtual size: 10KB

01
Certificate

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

96:4c:5b:a7:43:86:89:fc:39:95:f5:11:78:f6:17:e7:ab:54:7f:29:eb:fd:77:8a:e2:d4:a0:0b:d5:92:7c:c6
Signer

.text
Size: 560KB - Virtual size: 557KB

.data
Size: 4KB - Virtual size: 2KB

.rsrc
Size: 12KB - Virtual size: 10KB