jaffacakes118_Trojan-Banker[.]Win32[.]Bancos[.]ra[.]3bddfe4d55d8cf19409b9f211a666321

General

Target
jaffacakes118_Trojan-Banker.Win32.Bancos.ra.3bddfe4d55d8cf19409b9f211a666321
Size 283KB
Sample261014-kshpgsax9m
SHA256 b03dbd2e69d1028d52773e3bad14ed602f3781b4c171b90d04bb8b7a28d88348
MD5 3bddfe4d55d8cf19409b9f211a666321
SHA1 9527284c3410bb2acfd1f53c423af27253f7a34c
SHA512 3d94a47adfb5ec58663d2a9ca81e6023fa7020bcac790ba46bc65eefae0746268e34127f207696b53e1ba0c903580746acc43abbfc5dbebbc5f144d7bb43689f
SSDEEP 6144:YKQ1bsorWN0BZ+9YaNnDV0ery9/8UH6oRZ7qYogRt9:YdzDYpV0erkH3fSgRt9
TLSH
T1CC54DF5EF905F585F0EB45BCAC2858177A092E7402814D7EFB94269F30B2BA1B9E470F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan-Banker.Win32.Bancos.ra.3bddfe4d55d8cf19409b9f211a666321

File Explorer

jaffacakes118_Trojan-Banker.Win32.Bancos.ra.3bddfe4d55d8cf19409b9f211a666321

.exe 283KB

jaffacakes118_Trojan-Banker.Win32.Bancos.ra.3bddfe4d55d8cf19409b9f211a666321

IMPHASH 5901fc79e11986afe224eeda2aa8eb90
SHA256 b03dbd2e69d1028d52773e3bad14ed602f3781b4c171b90d04bb8b7a28d88348
MD5 3bddfe4d55d8cf19409b9f211a666321
SHA1 9527284c3410bb2acfd1f53c423af27253f7a34c
SHA512 3d94a47adfb5ec58663d2a9ca81e6023fa7020bcac790ba46bc65eefae0746268e34127f207696b53e1ba0c903580746acc43abbfc5dbebbc5f144d7bb43689f
SSDEEP 6144:YKQ1bsorWN0BZ+9YaNnDV0ery9/8UH6oRZ7qYogRt9:YdzDYpV0erkH3fSgRt9
TLSH
T1CC54DF5EF905F585F0EB45BCAC2858177A092E7402814D7EFB94269F30B2BA1B9E470F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

11128

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

EVENT_SINK_GetIDsOfNames __vbaVarSub __vbaStrI2 _CIcos _adj_fptan __vbaStrI4 __vbaHresultCheck __vbaVarMove __vbaVarVargNofree __vbaAryMove __vbaFreeVar __vbaStrVarMove __vbaLenBstr __vbaPut3 __vbaFreeVarList __vbaEnd _adj_fdiv_m64 __vbaPut4 EVENT_SINK_Invoke __vbaRaiseEvent __vbaFreeObjList __vbaStrErrVarCopy _adj_fprem1 __vbaRecAnsiToUni __vbaResume __vbaCopyBytes __vbaVarCmpNe __vbaStrCat __vbaLsetFixstr __vbaSetSystemError __vbaLenBstrB __vbaHresultCheckObj _adj_fdiv_m32 Zombie_GetTypeInfo __vbaAryDestruct __vbaExitProc __vbaVarForInit __vbaCyAdd __vbaOnError __vbaObjSet _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i __vbaStrFixstr __vbaBoolVarNull __vbaVarTstLt __vbaVargVar __vbaFpR8 _CIsin __vbaVarCmpGt __vbaChkstk __vbaI2Cy __vbaFileClose EVENT_SINK_AddRef __vbaGenerateBoundsError __vbaStrCmp __vbaCyI2 __vbaPutOwner3 __vbaAryConstruct2 __vbaVarTstEq __vbaCyI4 __vbaI2I4 DllFunctionCall __vbaVarOr __vbaCySub __vbaLbound __vbaRedimPreserve _adj_fpatan __vbaFixstrConstruct Zombie_GetTypeInfoCount __vbaRedim __vbaRecUniToAnsi EVENT_SINK_Release __vbaNew __vbaUI1I2 _CIsqrt __vbaVarAnd EVENT_SINK_QueryInterface __vbaUI1I4 __vbaStr2Vec __vbaStrUI1 __vbaFpCmpCy __vbaExceptHandler __vbaPrintFile __vbaStrToUnicode _adj_fprem _adj_fdivr_m64 __vbaFPException __vbaInStrVar __vbaGetOwner3 __vbaUbound __vbaStrVarVal __vbaVarCat __vbaLsetFixstrFree __vbaI2Var _CIlog __vbaErrorOverflow __vbaFileOpen __vbaVar2Vec __vbaNew2 __vbaInStr _adj_fdiv_m32i _adj_fdivr_m32i __vbaStrCopy __vbaVarNot __vbaFreeStrList __vbaVarCmpLt _adj_fdivr_m32 _adj_fdiv_r __vbaVarTstNe __vbaVarSetVar __vbaI4Var __vbaVarCmpEq __vbaVarAdd __vbaAryLock __vbaLateMemCall __vbaStrToAnsi __vbaVarDup __vbaFpI2 __vbaFpI4 __vbaVarCopy __vbaVarLateMemCallLd __vbaVarSetObjAddref _CIatan __vbaCastObj __vbaStrMove __vbaR8IntI4 __vbaI4Cy __vbaStrVarCopy _allmul _CItan __vbaAryUnlock __vbaVarForNext _CIexp __vbaFreeStr __vbaFreeObj

oleaut32

OleSavePictureFile

Sharing