jaffacakes118_Trojan-Dropper[.]Win32[.]Injector[.]pbuu[.]919bb31ec8e493d743020

General

Target
jaffacakes118_Trojan-Dropper.Win32.Injector.pbuu.919bb31ec8e493d743020
Size 192KB
Sample261009-xtargsea36
SHA256 43fb8efbe5946313146d7aa151b8e30bf3ecb845499a29d95a4e75c51e5ff076
MD5 2b759ea4e9b919bb31ec8e493d743020
SHA1 1ac9466baa6542e7039cb2b642c4a5de224dede1
SHA512 0516277507d8791dd840cc412017edd0511d4ccae56b3bf45961586bc19bcabe04c52750e244eb9e322a7a92694ff44ea598055cf4c238c79461ea9df9e5fc74
SSDEEP 3072:FlMqIeQnzTkayfHQjYYpjcMo0xOMb70SKPP6fBUcZ+Sdj:D+tEaADYY0xOMb70SKPP6fBUcZ+Sdj
TLSH
T1DF140813B94C9413E1AB42B108E61BB5C923FC2448569D2BB340FE9E3D7B68065AD37F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan-Dropper.Win32.Injector.pbuu.919bb31ec8e493d743020

File Explorer

jaffacakes118_Trojan-Dropper.Win32.Injector.pbuu.919bb31ec8e493d743020

.exe 192KB

jaffacakes118_Trojan-Dropper.Win32.Injector.pbuu.919bb31ec8e493d743020

IMPHASH c8b22632895d283b36dcc2cb55f2cbfb
SHA256 43fb8efbe5946313146d7aa151b8e30bf3ecb845499a29d95a4e75c51e5ff076
MD5 2b759ea4e9b919bb31ec8e493d743020
SHA1 1ac9466baa6542e7039cb2b642c4a5de224dede1
SHA512 0516277507d8791dd840cc412017edd0511d4ccae56b3bf45961586bc19bcabe04c52750e244eb9e322a7a92694ff44ea598055cf4c238c79461ea9df9e5fc74
SSDEEP 3072:FlMqIeQnzTkayfHQjYYpjcMo0xOMb70SKPP6fBUcZ+Sdj:D+tEaADYY0xOMb70SKPP6fBUcZ+Sdj
TLSH
T1DF140813B94C9413E1AB42B108E61BB5C923FC2448569D2BB340FE9E3D7B68065AD37F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

197194

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

user32

GetWindowThreadProcessId

kernel32

GetVersion Sleep

advapi32

RegCloseKey RegSetValueExA RegOpenKeyExA RegQueryValueExA

msvbvm60

EVENT_SINK_GetIDsOfNames __vbaVarTstGt __vbaVarSub __vbaStrI2 _CIcos _adj_fptan __vbaStrI4 __vbaVarMove __vbaVarVargNofree __vbaFreeVar __vbaLenBstr __vbaStrVarMove __vbaEnd __vbaFreeVarList _adj_fdiv_m64 EVENT_SINK_Invoke __vbaRaiseEvent __vbaFreeObjList __vbaStrErrVarCopy _adj_fprem1 __vbaRecAnsiToUni ord518 __vbaResume __vbaStrCat __vbaError __vbaWriteFile __vbaSetSystemError __vbaHresultCheckObj ord558 __vbaVargVarCopy __vbaLenVar _adj_fdiv_m32 __vbaVarTstLe Zombie_GetTypeInfo __vbaAryDestruct __vbaLateMemSt ord591 ord592 __vbaForEachCollObj __vbaExitProc ord595 __vbaStrLike __vbaOnError __vbaObjSet _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i ord598 __vbaFpR4 __vbaBoolVar ord520 __vbaStrFixstr __vbaBoolVarNull _CIsin ord524 ord709 ord632 __vbaVarZero __vbaVargVarMove __vbaNextEachCollObj __vbaChkstk __vbaFileClose ord526 EVENT_SINK_AddRef ord528 __vbaGenerateBoundsError __vbaStrCmp __vbaVarTstEq ord561 __vbaObjVar __vbaI2I4 DllFunctionCall ord562 __vbaVarOr __vbaVarLateMemSt __vbaCastObjVar __vbaRedimPreserve __vbaStrR4 _adj_fpatan __vbaLateIdCallLd Zombie_GetTypeInfoCount __vbaRedim __vbaRecUniToAnsi EVENT_SINK_Release __vbaNew _CIsqrt __vbaObjIs EVENT_SINK_QueryInterface __vbaExceptHandler __vbaPrintFile __vbaInputFile ord712 __vbaStrToUnicode _adj_fprem _adj_fdivr_m64 ord607 __vbaFailedFriend ord608 ord716 __vbaFPException __vbaInStrVar __vbaStrCompVar ord319 __vbaStrVarVal __vbaUbound __vbaVarCat ord535 __vbaI2Var __vbaLsetFixstrFree ord537 ord644 ord645 _CIlog __vbaErrorOverflow ord647 __vbaFileOpen ord648 __vbaInStr __vbaNew2 _adj_fdiv_m32i _adj_fdivr_m32i __vbaStrCopy __vbaI4Str ord681 __vbaFreeStrList _adj_fdivr_m32 __vbaPowerR8 __vbaR8Var _adj_fdiv_r ord685 ord100 ord579 __vbaVarTstNe __vbaI4Var __vbaVarCmpEq __vbaAryLock __vbaVarAdd ord320 __vbaStrToAnsi __vbaVarDup ord321 ord613 __vbaFpI2 __vbaFpI4 __vbaVarCopy ord616 __vbaUnkVar ord617 __vbaLateMemCallLd _CIatan ord618 __vbaCastObj __vbaStrMove ord619 _allmul __vbaLateIdSt _CItan ord546 __vbaAryUnlock _CIexp __vbaFreeObj __vbaFreeStr

Sharing