jaffacakes118_Backdoor[.]Win32[.]Acidoor[.]b[.]32ef12d6940c30a9338d6ca6001780d8

General

Target
jaffacakes118_Backdoor.Win32.Acidoor.b.32ef12d6940c30a9338d6ca6001780d8
Size 156KB
Sample261011-y9gqeacy21
SHA256 2bf85d58a82d63d16a1b4f3e650780e0015a8f26172e5d22480c4b6cca0b806b
MD5 32ef12d6940c30a9338d6ca6001780d8
SHA1 975f9bb1aaff68b110e7ee6d3dc9bceeafbabbf9
SHA512 e89423f07679158e3f9101fbbd50c7bc09b5c6d7108bb14aaeaa40aa6a98ea4a7922e4b1649f970aa221a59766a54a2e3d0c056d51cc8a0baed62a91296010fb
SSDEEP 1536:qxTD5+JV2yDxgcq59wJY8IiffUvvZqHyiM3Jj5T5+4H0Nw4oJfRcxbpsLBTPvitl:MTsTTDxgcqDFHQyzZj5T5+9N+CNpqK3
TLSH
T100F3956E3290E7B6F21145FD3B2E7298899C3C342264A857F7C09B2577F0B976A21353
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Backdoor.Win32.Acidoor.b.32ef12d6940c30a9338d6ca6001780d8

File Explorer

jaffacakes118_Backdoor.Win32.Acidoor.b.32ef12d6940c30a9338d6ca6001780d8

.exe 156KB

jaffacakes118_Backdoor.Win32.Acidoor.b.32ef12d6940c30a9338d6ca6001780d8

IMPHASH 13479c6ca25aaad037ce86d2fe68960d
SHA256 2bf85d58a82d63d16a1b4f3e650780e0015a8f26172e5d22480c4b6cca0b806b
MD5 32ef12d6940c30a9338d6ca6001780d8
SHA1 975f9bb1aaff68b110e7ee6d3dc9bceeafbabbf9
SHA512 e89423f07679158e3f9101fbbd50c7bc09b5c6d7108bb14aaeaa40aa6a98ea4a7922e4b1649f970aa221a59766a54a2e3d0c056d51cc8a0baed62a91296010fb
SSDEEP 1536:qxTD5+JV2yDxgcq59wJY8IiffUvvZqHyiM3Jj5T5+4H0Nw4oJfRcxbpsLBTPvitl:MTsTTDxgcqDFHQyzZj5T5+9N+CNpqK3
TLSH
T100F3956E3290E7B6F21145FD3B2E7298899C3C342264A857F7C09B2577F0B976A21353
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10032

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

__vbaVarSub __vbaStrI2 _CIcos _adj_fptan __vbaVarMove __vbaStrI4 __vbaVarVargNofree __vbaFreeVar __vbaLateIdCall __vbaLenBstr __vbaStrVarMove __vbaFreeVarList __vbaPut3 __vbaEnd _adj_fdiv_m64 __vbaPut4 __vbaFreeObjList ord516 __vbaVarFix ord517 _adj_fprem1 __vbaRecAnsiToUni ord519 __vbaCopyBytes __vbaVarCmpNe __vbaStrCat ord660 __vbaLsetFixstr __vbaRecDestruct __vbaSetSystemError __vbaHresultCheckObj __vbaLenVar _adj_fdiv_m32 __vbaAryDestruct __vbaExitProc __vbaVarForInit __vbaObjSet __vbaOnError ord595 _adj_fdiv_m16i _adj_fdivr_m16i ord598 ord520 __vbaStrFixstr __vbaBoolVarNull _CIsin ord631 __vbaVargVarMove ord632 __vbaChkstk __vbaFileClose ord526 EVENT_SINK_AddRef ord527 ord528 __vbaGenerateBoundsError __vbaGet3 ord529 __vbaStrCmp __vbaVarTstEq __vbaAryConstruct2 __vbaGet4 __vbaI2I4 DllFunctionCall __vbaVarOr __vbaCastObjVar __vbaRedimPreserve __vbaLbound _adj_fpatan __vbaLateIdCallLd __vbaRedim __vbaRecUniToAnsi EVENT_SINK_Release ord600 __vbaUI1I2 _CIsqrt __vbaVarAnd EVENT_SINK_QueryInterface __vbaVarMul __vbaExceptHandler __vbaStrToUnicode ord606 _adj_fprem _adj_fdivr_m64 __vbaVarDiv ord607 ord608 ord531 __vbaFPException __vbaInStrVar __vbaUbound __vbaStrVarVal __vbaVarCat ord536 __vbaI2Var __vbaStopExe ord644 ord537 _CIlog __vbaErrorOverflow __vbaFileOpen __vbaInStr ord648 ord570 __vbaNew2 ord571 _adj_fdiv_m32i _adj_fdivr_m32i ord573 __vbaStrCopy ord681 __vbaI4Str __vbaFreeStrList __vbaDerefAry1 ord576 _adj_fdivr_m32 __vbaPowerR8 _adj_fdiv_r ord578 ord100 __vbaVarTstNe __vbaI4Var __vbaVarCmpEq __vbaAryLock __vbaVarAdd __vbaVarDup __vbaStrToAnsi __vbaVarMod __vbaVarCopy ord616 __vbaRecDestructAnsi ord617 _CIatan __vbaStrMove ord618 ord619 _allmul _CItan __vbaAryUnlock __vbaVarForNext _CIexp __vbaFreeObj __vbaI4ErrVar __vbaFreeStr

Sharing