jaffacakes118_Trojan[.]Win32[.]Kovter[.]acpo[.]61c2de40c339651f4e62998281566ff4

General

Target
jaffacakes118_Trojan.Win32.Kovter.acpo.61c2de40c339651f4e62998281566ff4
Size 265KB
Sample261014-md65msbv7t
SHA256 c6a2549777b1eaaeb16a7877e391ad61cbadc8c13507dc66814115956e9b01d9
MD5 61c2de40c339651f4e62998281566ff4
SHA1 4f12dbac530ea7e49005dddfc148743d8690612c
SHA512 2fb879a2b7c1daac8281cb688f49d019b662280e4509cfabaad4008fb15a083f2c4086bd1a3ff28b56649d170b3c71a56c913fc45d4689828e7d2410436505e4
SSDEEP 6144:MTCmqlwVyXgmm51/XM/L4kp7PGyGgYgV8lMur:MTX/c/77ZGgYgV8lrr
TLSH
T1C444F1B559BC4417E12DC6B1FFE4A5A36864FE3228364F263406F95D0A30802699F7FB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan.Win32.Kovter.acpo.61c2de40c339651f4e62998281566ff4

File Explorer

jaffacakes118_Trojan.Win32.Kovter.acpo.61c2de40c339651f4e62998281566ff4

.exe 265KB

jaffacakes118_Trojan.Win32.Kovter.acpo.61c2de40c339651f4e62998281566ff4

IMPHASH 729bdbc9f732964b3185b6bb564b23f7
SHA256 c6a2549777b1eaaeb16a7877e391ad61cbadc8c13507dc66814115956e9b01d9
MD5 61c2de40c339651f4e62998281566ff4
SHA1 4f12dbac530ea7e49005dddfc148743d8690612c
SHA512 2fb879a2b7c1daac8281cb688f49d019b662280e4509cfabaad4008fb15a083f2c4086bd1a3ff28b56649d170b3c71a56c913fc45d4689828e7d2410436505e4
SSDEEP 6144:MTCmqlwVyXgmm51/XM/L4kp7PGyGgYgV8lMur:MTX/c/77ZGgYgV8lrr
TLSH
T1C444F1B559BC4417E12DC6B1FFE4A5A36864FE3228364F263406F95D0A30802699F7FB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5448

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

__vbaVarTstGt _CIcos _adj_fptan __vbaStrI4 __vbaVarMove __vbaVarVargNofree __vbaAryMove __vbaFreeVar __vbaStrVarMove __vbaLenBstr __vbaFreeVarList _adj_fdiv_m64 ord516 _adj_fprem1 __vbaResume __vbaStrCat ord661 __vbaSetSystemError __vbaHresultCheckObj _adj_fdiv_m32 __vbaAryDestruct __vbaExitProc __vbaOnError ord595 __vbaObjSet _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i ord598 __vbaVarIndexLoad ord520 __vbaBoolVarNull __vbaVargVar _CIsin ord631 ord632 __vbaChkstk ord526 __vbaFileClose EVENT_SINK_AddRef __vbaGenerateBoundsError __vbaGet3 __vbaVarTstEq __vbaAryConstruct2 __vbaObjVar DllFunctionCall __vbaVarLateMemSt ord563 __vbaLbound _adj_fpatan __vbaRedim __vbaUI1ErrVar EVENT_SINK_Release __vbaUI1I2 _CIsqrt EVENT_SINK_QueryInterface __vbaStrUI1 __vbaUI1I4 __vbaExceptHandler ord711 __vbaInputFile __vbaPrintFile ord712 ord606 _adj_fprem _adj_fdivr_m64 ord531 __vbaFPException ord717 __vbaStrVarVal __vbaUbound __vbaVarCat _CIlog __vbaErrorOverflow __vbaFileOpen __vbaVarLateMemCallLdRf __vbaVar2Vec ord570 __vbaNew2 _adj_fdiv_m32i _adj_fdivr_m32i ord573 __vbaStrCopy __vbaVarNot __vbaFreeStrList _adj_fdivr_m32 _adj_fdiv_r ord685 ord100 __vbaVarSetVar __vbaI4Var __vbaVarCmpEq __vbaLateMemCall __vbaVarAdd ord611 __vbaAryLock __vbaVarDup __vbaVarCopy __vbaVarLateMemCallLd __vbaFpI4 __vbaVarSetObjAddref _CIatan __vbaAryCopy __vbaStrMove __vbaR8IntI4 __vbaStrVarCopy _allmul __vbaVarLateMemCallSt _CItan ord546 __vbaAryUnlock _CIexp __vbaMidStmtBstr __vbaFreeObj __vbaFreeStr ord581

Sharing