jaffacakes118_Trojan[.]Win32[.]Buzus[.]ocwd[.]f484c11537f5b11ebaed14dc2bd117d7

General

Target
jaffacakes118_Trojan.Win32.Buzus.ocwd.f484c11537f5b11ebaed14dc2bd117d7
Size 344KB
Sample261018-1vdrbaa151
SHA256 208b5b776a6aed971e192795154d26b5967d8bb9b0e1dbf2223d87cf3d3aa34b
MD5 f484c11537f5b11ebaed14dc2bd117d7
SHA1 b34a36ea3416fbb33f9475fbced8e2c887ce1ff8
SHA512 d3613e3ee5829a675c062cf4a6a07097d40a4cef3260e762210b3648c63fcc3b4ce25825ce53e56bc31f551ad5136f01f4719e5c34f8886da255178c9d14aa9e
SSDEEP 3072:7DRyK2mC8LzOSsOnMLKg0lq91+BUnRPeUbC2GDUnYriJPw2927e:P9dsOM+qKBUnlCAv55
TLSH
T1B8741A27B2A4D547C3924AF10F6A9AE8953DAD705153C84766C43F0DBB73E07AA23327
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan.Win32.Buzus.ocwd.f484c11537f5b11ebaed14dc2bd117d7

File Explorer

jaffacakes118_Trojan.Win32.Buzus.ocwd.f484c11537f5b11ebaed14dc2bd117d7

.exe 344KB

jaffacakes118_Trojan.Win32.Buzus.ocwd.f484c11537f5b11ebaed14dc2bd117d7

IMPHASH d7143347333ace504c7bf8b0961d7a90
SHA256 208b5b776a6aed971e192795154d26b5967d8bb9b0e1dbf2223d87cf3d3aa34b
MD5 f484c11537f5b11ebaed14dc2bd117d7
SHA1 b34a36ea3416fbb33f9475fbced8e2c887ce1ff8
SHA512 d3613e3ee5829a675c062cf4a6a07097d40a4cef3260e762210b3648c63fcc3b4ce25825ce53e56bc31f551ad5136f01f4719e5c34f8886da255178c9d14aa9e
SSDEEP 3072:7DRyK2mC8LzOSsOnMLKg0lq91+BUnRPeUbC2GDUnYriJPw2927e:P9dsOM+qKBUnlCAv55
TLSH
T1B8741A27B2A4D547C3924AF10F6A9AE8953DAD705153C84766C43F0DBB73E07AA23327
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

14012

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

EVENT_SINK_GetIDsOfNames __vbaVarSub __vbaStrI2 _CIcos _adj_fptan __vbaStrI4 __vbaVarMove __vbaFreeVar ord588 __vbaLenBstr __vbaStrVarMove __vbaVarIdiv __vbaFreeVarList __vbaPut3 _adj_fdiv_m64 EVENT_SINK_Invoke __vbaRaiseEvent __vbaFreeObjList ord516 ord517 _adj_fprem1 __vbaRecAnsiToUni ord519 __vbaCopyBytes __vbaForEachCollAd __vbaStrCat __vbaLsetFixstr __vbaRecDestruct __vbaSetSystemError __vbaHresultCheckObj _adj_fdiv_m32 __vbaAryVar ord667 Zombie_GetTypeInfo __vbaAryDestruct __vbaStrBool __vbaExitProc __vbaStrLike ord595 __vbaObjSet __vbaOnError ord596 _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i ord598 ord599 __vbaStrFixstr __vbaBoolVar __vbaBoolVarNull _CIsin ord709 ord631 __vbaErase ord632 ord525 __vbaChkstk __vbaCyVar ord526 __vbaFileClose EVENT_SINK_AddRef __vbaGenerateBoundsError ord528 __vbaExitEachColl __vbaStrCmp __vbaAryConstruct2 __vbaVarTstEq __vbaGet4 ord561 DllFunctionCall __vbaFpUI1 __vbaCastObjVar __vbaRedimPreserve __vbaLbound _adj_fpatan __vbaLateIdCallLd Zombie_GetTypeInfoCount __vbaRedim __vbaRecUniToAnsi EVENT_SINK_Release __vbaNew _CIsqrt __vbaVarAnd __vbaObjIs EVENT_SINK_QueryInterface __vbaExceptHandler ord711 ord712 __vbaStrToUnicode ord606 _adj_fprem _adj_fdivr_m64 ord608 __vbaFPException ord717 __vbaInStrVar ord319 __vbaStrVarVal __vbaUbound __vbaVarCat __vbaCheckType __vbaI2Var ord644 ord537 _CIlog __vbaFileOpen __vbaInStr __vbaNew2 ord570 __vbaCyMulI2 _adj_fdiv_m32i _adj_fdivr_m32i ord573 __vbaStrCopy __vbaI4Str ord681 __vbaFreeStrList __vbaDerefAry1 _adj_fdivr_m32 _adj_fdiv_r ord685 ord100 __vbaVarTstNe __vbaI4Var __vbaVarCmpEq __vbaVarAdd __vbaAryLock ord320 __vbaVarDup __vbaStrToAnsi ord321 __vbaFpI2 ord616 __vbaVarLateMemCallLd __vbaFpI4 __vbaVarCopy ord617 __vbaRecDestructAnsi __vbaLateMemCallLd _CIatan ord618 __vbaCastObj __vbaStrMove __vbaAryCopy __vbaI4Cy ord619 _allmul __vbaFpCSngR4 __vbaLateIdSt _CItan __vbaNextEachCollAd __vbaFPInt __vbaAryUnlock _CIexp __vbaMidStmtBstr __vbaRecAssign __vbaFreeObj __vbaFreeStr ord581

Sharing