jaffacakes118_Trojan-Spy[.]Win32[.]VB[.]plk[.]b14d90785953677a1985b3a1e2930022

General

Target
jaffacakes118_Trojan-Spy.Win32.VB.plk.b14d90785953677a1985b3a1e2930022
Size 68KB
Sample261018-3bkrmada63
SHA256 cea0efacc42ff6b2b57a4f99f1233d3275094b257ecdb62e163227b1c2801681
MD5 b14d90785953677a1985b3a1e2930022
SHA1 c954e23da359955f9765a4c41b755ab3f8e089ae
SHA512 ab8622568fe9784deb1d2f78d1ecbf0c9fcb4a48fe1f396ddae6f19d48820165e79dd1a0135a77b8e0f5214154fcfbfe73b4656d8cf4c428655f0e90a7d96294
SSDEEP 1536:urOymyyrymyyrRf7T705od9QP0zEymyyPV:pymyyrymyyrlT705iOnymyyPV
TLSH
T1D363EA16F718A213F1450670199241D93ABA3D3625929C0BF78D6F9CBB71287EDF0B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan-Spy.Win32.VB.plk.b14d90785953677a1985b3a1e2930022

File Explorer

jaffacakes118_Trojan-Spy.Win32.VB.plk.b14d90785953677a1985b3a1e2930022

.exe 68KB

jaffacakes118_Trojan-Spy.Win32.VB.plk.b14d90785953677a1985b3a1e2930022

IMPHASH 198a2a04cd6f84798d5ebfb7b2310d75
SHA256 cea0efacc42ff6b2b57a4f99f1233d3275094b257ecdb62e163227b1c2801681
MD5 b14d90785953677a1985b3a1e2930022
SHA1 c954e23da359955f9765a4c41b755ab3f8e089ae
SHA512 ab8622568fe9784deb1d2f78d1ecbf0c9fcb4a48fe1f396ddae6f19d48820165e79dd1a0135a77b8e0f5214154fcfbfe73b4656d8cf4c428655f0e90a7d96294
SSDEEP 1536:urOymyyrymyyrRf7T705od9QP0zEymyyPV:pymyyrymyyrlT705iOnymyyPV
TLSH
T1D363EA16F718A213F1450670199241D93ABA3D3625929C0BF78D6F9CBB71287EDF0B2B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5812

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

EVENT_SINK_GetIDsOfNames __vbaVarTstGt __vbaVarSub __vbaVarTextCmpGe _CIcos _adj_fptan __vbaStrI4 __vbaVarMove __vbaVarVargNofree __vbaFreeVar __vbaLenBstr __vbaStrVarMove __vbaEnd __vbaFreeVarList _adj_fdiv_m64 EVENT_SINK_Invoke __vbaVarIndexStore ord621 __vbaRaiseEvent __vbaFreeObjList __vbaStrErrVarCopy _adj_fprem1 ord518 __vbaStrCat __vbaLsetFixstr ord553 __vbaVarTextTstEq __vbaSetSystemError __vbaHresultCheckObj _adj_fdiv_m32 ord666 Zombie_GetTypeInfo __vbaAryDestruct __vbaVarCmpGe __vbaObjSet __vbaOnError _adj_fdiv_m16i _adj_fdivr_m16i ord598 __vbaStrTextCmp __vbaRefVarAry __vbaBoolVarNull _CIsin __vbaErase ord631 __vbaVarCmpGt ord525 __vbaVarTextCmpLe __vbaVargVarMove __vbaChkstk __vbaFileClose EVENT_SINK_AddRef ord528 __vbaStrCmp __vbaObjVar __vbaI2I4 DllFunctionCall __vbaVarLateMemSt _adj_fpatan __vbaFixstrConstruct Zombie_GetTypeInfoCount EVENT_SINK_Release __vbaNew ord600 _CIsqrt __vbaVarAnd EVENT_SINK_QueryInterface __vbaExceptHandler ord711 __vbaPrintFile __vbaStrToUnicode ord712 ord606 _adj_fprem _adj_fdivr_m64 __vbaI2Str ord608 ord716 __vbaFPException ord717 ord319 __vbaStrVarVal __vbaUbound __vbaVarCat __vbaI2Var ord537 ord645 _CIlog __vbaErrorOverflow __vbaFileOpen ord648 __vbaNew2 __vbaVar2Vec ord570 __vbaVarLateMemCallLdRf __vbaInStr _adj_fdiv_m32i _adj_fdivr_m32i __vbaStrCopy ord681 __vbaVarNot __vbaVarCmpLt __vbaFreeStrList ord576 _adj_fdivr_m32 _adj_fdiv_r ord100 __vbaVarSetVar __vbaI4Var ord610 __vbaLateMemCall __vbaVarAdd ord320 ord612 __vbaStrToAnsi __vbaVarDup ord321 __vbaVarLateMemCallLd __vbaVarTstGe ord616 __vbaVarCopy _CIatan __vbaStrMove __vbaStrVarCopy ord542 _allmul ord545 _CItan _CIexp __vbaFreeObj __vbaFreeStr

Sharing