jaffacakes118_Trojan-Dropper[.]Win32[.]Dinwod[.]qfi[.]26522148bf55e4edb1498bb13e477439

General

Target
jaffacakes118_Trojan-Dropper.Win32.Dinwod.qfi.26522148bf55e4edb1498bb13e477439
Size 68KB
Sample261009-w3prbsssb1
SHA256 e17df7f7fb58d61bc9d80f155a3a1293bc3fef9f83188668ed911b370ef5ab98
MD5 26522148bf55e4edb1498bb13e477439
SHA1 f5bf593664d2a6ffe4dcf03f325b990b6c05a1f7
SHA512 0c8bbeb851f53a3f3c6a127e0589f7518dcaa69011be5923046761efc65db8af215f834799c4d95af6fe01e89ab8911b4d8e55e4b5a0f85c35e9d77d2d2ff00d
SSDEEP 1536:Za8bqIxJXcY6JcbGPY6iBSs4zPy+wqqVmu:Jq2JXcY6KbJAs6Py+fOx
TLSH
T15463750FB2987231D1A5097C1975E574261FBD389BC9986BE342FB0939F2F81AD22317
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan-Dropper.Win32.Dinwod.qfi.26522148bf55e4edb1498bb13e477439

File Explorer

jaffacakes118_Trojan-Dropper.Win32.Dinwod.qfi.26522148bf55e4edb1498bb13e477439

.exe 68KB

jaffacakes118_Trojan-Dropper.Win32.Dinwod.qfi.26522148bf55e4edb1498bb13e477439

IMPHASH d0ffe132e4ce4da19efc7eb69ebe10d4
SHA256 e17df7f7fb58d61bc9d80f155a3a1293bc3fef9f83188668ed911b370ef5ab98
MD5 26522148bf55e4edb1498bb13e477439
SHA1 f5bf593664d2a6ffe4dcf03f325b990b6c05a1f7
SHA512 0c8bbeb851f53a3f3c6a127e0589f7518dcaa69011be5923046761efc65db8af215f834799c4d95af6fe01e89ab8911b4d8e55e4b5a0f85c35e9d77d2d2ff00d
SSDEEP 1536:Za8bqIxJXcY6JcbGPY6iBSs4zPy+wqqVmu:Jq2JXcY6KbJAs6Py+fOx
TLSH
T15463750FB2987231D1A5097C1975E574261FBD389BC9986BE342FB0939F2F81AD22317
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5700

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

ord690 __vbaStrI2 _CIcos _adj_fptan __vbaVarMove __vbaVarVargNofree __vbaFreeVar __vbaLineInputStr __vbaLenBstr __vbaStrVarMove __vbaFreeVarList _adj_fdiv_m64 __vbaFreeObjList __vbaGetFxStr3 ord516 _adj_fprem1 __vbaRecAnsiToUni __vbaStrCat __vbaLsetFixstr __vbaSetSystemError __vbaHresultCheckObj _adj_fdiv_m32 __vbaAryVar __vbaAryDestruct ord593 ord594 ord595 __vbaOnError __vbaObjSet _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i ord598 _CIsin __vbaErase ord525 ord632 __vbaVarZero __vbaChkstk ord526 __vbaFileClose EVENT_SINK_AddRef __vbaStrCmp __vbaGet3 __vbaAryConstruct2 DllFunctionCall _adj_fpatan __vbaFixstrConstruct __vbaRedim __vbaRecUniToAnsi EVENT_SINK_Release _CIsqrt EVENT_SINK_QueryInterface __vbaExceptHandler ord711 __vbaStrToUnicode ord713 _adj_fprem _adj_fdivr_m64 ord607 ord608 __vbaFPException ord717 __vbaStrVarVal __vbaUbound __vbaVarCat __vbaLsetFixstrFree __vbaFileSeek ord644 ord645 _CIlog __vbaFileOpen ord648 ord570 __vbaR8Str __vbaVar2Vec __vbaNew2 ord571 _adj_fdiv_m32i _adj_fdivr_m32i __vbaStrCopy ord681 __vbaI4Str __vbaFreeStrList _adj_fdivr_m32 _adj_fdiv_r ord100 __vbaVarTstNe __vbaI4Var ord689 __vbaAryLock __vbaVarDup __vbaStrToAnsi __vbaVarCopy __vbaFpI4 ord616 _CIatan __vbaAryCopy __vbaStrMove __vbaR8IntI4 _allmul _CItan __vbaAryUnlock _CIexp __vbaFreeStr __vbaI4ErrVar __vbaFreeObj

Sharing