JaffaCakes118_a9a86cc663da436d7cb53716088f7b94 | Triage

Sharing

General

Target

JaffaCakes118_a9a86cc663da436d7cb53716088f7b94
Size

3.3MB
MD5

a9a86cc663da436d7cb53716088f7b94
SHA1

bb63636ec07e6efadc3854462cdb99a6ff1500c3
SHA256

8041b51c8456106f557803b98c4579c2e720f4b5a184a853c19a3155ffa44b11
SHA512

2a90ad5e1bb420f289d80340be0ebce70c7734f6848eb1163b8074cb00bc82dd21c452b53b5fa4fea4d59d8fd42d7a3e9d1c87abb1f479f0633a92531debf32b
SSDEEP

98304:o06cZJ+wPOa2lMqvB4buVEucwK1EFrAg:o8/+wP0j4bu6ufK1EFr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_a9a86cc663da436d7cb53716088f7b94

NSIS installer 1 IoCs

resource	yara_rule
sample	nsis_installer_2

Files

JaffaCakes118_a9a86cc663da436d7cb53716088f7b94
.exe windows:4 windows x86 arch:x86

b16cf5c4436d2856ae5c776672d724b5

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

RtlMoveMemory

msvbvm60

MethCallEngine
ord516
ord598
ord631
EVENT_SINK_AddRef
ord527
DllFunctionCall
EVENT_SINK_Release
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord606
ProcCallEngine
ord537
ord644
ord572
ord100
ord616
ord618

Sections

.text
Size: 136KB - Virtual size: 135KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ