jaffacakes118_Trojan[.]Win32[.]Agent[.]qwhebb[.]ee41242541a4703636d5208597430fc9

General

Target
jaffacakes118_Trojan.Win32.Agent.qwhebb.ee41242541a4703636d5208597430fc9
Size 1.3MB
Sample261015-3ce8jaex2r
SHA256 e30f8aef11a5ffc41c5ca2e13c1837adab3eb8bffe283aced374742d02f86350
MD5 ee41242541a4703636d5208597430fc9
SHA1 235f6ed0dbefb705e7af08330b5cf68bf46ae3ba
SHA512 fe129ced0f557dcec645debc29555c0dc08b8e21f4926c90ae77c0ac58471a80b78902ad529f38fcd940a1ed3f2ff3814b30a6fb36e85c4da2bfc776f09f8f61
SSDEEP 24576:gIYcXUFyukoS++ZDUa1lax8Yr0ep5lTFBG3xN5obF83:DYcSwDUa1lax8YrbBG3xN5obF8
TLSH
T13E55F813E210B2CEED03C0B26478962B28582D361589B947F3463F167575AE3BAF5B1F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan.Win32.Agent.qwhebb.ee41242541a4703636d5208597430fc9

File Explorer

jaffacakes118_Trojan.Win32.Agent.qwhebb.ee41242541a4703636d5208597430fc9

.exe 1.3MB

jaffacakes118_Trojan.Win32.Agent.qwhebb.ee41242541a4703636d5208597430fc9

IMPHASH df265c8b722f3017128185e2ef999dac
SHA256 e30f8aef11a5ffc41c5ca2e13c1837adab3eb8bffe283aced374742d02f86350
MD5 ee41242541a4703636d5208597430fc9
SHA1 235f6ed0dbefb705e7af08330b5cf68bf46ae3ba
SHA512 fe129ced0f557dcec645debc29555c0dc08b8e21f4926c90ae77c0ac58471a80b78902ad529f38fcd940a1ed3f2ff3814b30a6fb36e85c4da2bfc776f09f8f61
SSDEEP 24576:gIYcXUFyukoS++ZDUa1lax8Yr0ep5lTFBG3xN5obF83:DYcSwDUa1lax8YrbBG3xN5obF8
TLSH
T13E55F813E210B2CEED03C0B26478962B28582D361589B947F3463F167575AE3BAF5B1F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

41148

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

__vbaVarTstGt __vbaVarSub __vbaStrI2 _CIcos _adj_fptan __vbaVarMove __vbaStrI4 __vbaVarVargNofree __vbaAryMove __vbaFreeVar __vbaLateIdCall __vbaStrVarMove __vbaLenBstr ord696 ord697 __vbaFreeVarList __vbaEnd __vbaVarIdiv _adj_fdiv_m64 ord698 __vbaVarIndexStore __vbaNextEachVar __vbaFreeObjList __vbaLineInputVar ord516 __vbaVarIndexLoadRef __vbaStrErrVarCopy _adj_fprem1 __vbaRecAnsiToUni ord518 ord626 __vbaResume __vbaCopyBytes __vbaStrCat __vbaVarCmpNe ord553 __vbaLsetFixstr __vbaRecDestruct __vbaSetSystemError __vbaLenBstrB __vbaHresultCheckObj __vbaLenVar _adj_fdiv_m32 ord666 __vbaAryVar __vbaVarTstLe __vbaVarCmpGe __vbaAryDestruct __vbaLateMemSt __vbaVarIndexLoadRefLock __vbaExitProc ord593 __vbaVarForInit __vbaStrBool ord300 ord594 __vbaI4Abs __vbaCyAdd ord595 __vbaOnError __vbaObjSet _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i __vbaVarIndexLoad ord598 __vbaFpR4 ord306 __vbaStrFixstr ord520 __vbaFPFix __vbaBoolVarNull __vbaRefVarAry __vbaVarTstLt __vbaFpR8 _CIsin __vbaErase ord631 ord525 __vbaVargVarMove ord632 __vbaVarCmpGt __vbaChkstk __vbaCyVar __vbaFileClose EVENT_SINK_AddRef __vbaGenerateBoundsError ord528 __vbaCyI2 __vbaStrCmp ord529 __vbaAryConstruct2 __vbaVarTstEq __vbaDateR8 __vbaR4Str __vbaPrintObj __vbaI2I4 __vbaObjVar DllFunctionCall ord670 __vbaVarOr __vbaVarLateMemSt __vbaCySub __vbaFpUI1 __vbaLbound __vbaStrR4 _adj_fpatan __vbaR4Var __vbaFixstrConstruct __vbaR4Cy __vbaLateIdCallLd __vbaRedim __vbaStrR8 __vbaRecUniToAnsi EVENT_SINK_Release __vbaNew ord600 __vbaUI1I2 _CIsqrt __vbaObjIs __vbaVarAnd EVENT_SINK_QueryInterface __vbaUI1I4 __vbaVarMul __vbaExceptHandler ord711 ord712 __vbaPrintFile __vbaStrToUnicode ord606 ord713 _adj_fprem _adj_fdivr_m64 ord607 __vbaVarDiv ord608 ord716 ord531 __vbaVarCmpLe __vbaFPException ord717 __vbaInStrVar ord532 __vbaStrVarVal __vbaUbound __vbaVarCat __vbaDateVar ord535 __vbaI2Var ord537 ord644 ord645 _CIlog __vbaErrorOverflow __vbaFileOpen __vbaVar2Vec __vbaNew2 __vbaInStr __vbaR8Str __vbaVarLateMemCallLdRf __vbaCyMulI2 ord571 _adj_fdiv_m32i _adj_fdivr_m32i ord573 __vbaStrCopy __vbaI4Str __vbaVarNot __vbaFreeStrList __vbaVarCmpLt ord576 _adj_fdivr_m32 __vbaPowerR8 _adj_fdiv_r ord685 ord100 ord579 __vbaVarTstNe __vbaVarSetVar __vbaI4Var __vbaVarCmpEq ord610 __vbaVarAdd __vbaLateMemCall __vbaAryLock ord612 __vbaVarDup __vbaStrToAnsi __vbaFpI2 __vbaVarMod __vbaUnkVar ord616 __vbaFpI4 __vbaVarCopy __vbaVarLateMemCallLd __vbaVarTstGe __vbaVarSetObjAddref ord617 __vbaLateMemCallLd _CIatan ord618 __vbaStrMove __vbaAryCopy __vbaCastObj __vbaForEachVar __vbaR8IntI4 ord619 __vbaStrVarCopy __vbaVarNeg ord542 ord650 _allmul __vbaLenVarB __vbaLateIdSt ord545 _CItan ord546 __vbaFPInt __vbaAryUnlock __vbaVarForNext _CIexp ord580 __vbaI4ErrVar __vbaFreeObj __vbaFreeStr ord581

Sharing