jaffacakes118_Trojan[.]Win32[.]Buzus[.]gzue[.]7c0228381f07a1c16d67c98c69512342

General

Target
jaffacakes118_Trojan.Win32.Buzus.gzue.7c0228381f07a1c16d67c98c69512342
Size 72KB
Sample261018-3lencsav6k
SHA256 7f906e7d421f9aef3f4a2edffde1507f916f7b1ff84c49dfbe7f7749091af564
MD5 7c0228381f07a1c16d67c98c69512342
SHA1 49b939c63f8e1c909c46ba1bc08900da81b3b865
SHA512 21b00220e626f02cd8a39ab23ea12565a0165556a806f836f7ab5a99ee9b8a34e80f5ac280e4599cde12048dc41979e8f3895b36e60a9347f1e62fbf9fa38963
SSDEEP 768:PbcfdQAB0/601ARtO4SYjWwuDmYJbLSjmtpUD477t3eu4iaTUOGbFAA48jSES+Vf:EaAe/ATOSjWTDmALSCPPt2KFA8jQIz
TLSH
T17B739E1E736CA4B7F16D81B5C842D47854693C363A8D8C4BE24FBB592DB8804B6B072B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan.Win32.Buzus.gzue.7c0228381f07a1c16d67c98c69512342

File Explorer

jaffacakes118_Trojan.Win32.Buzus.gzue.7c0228381f07a1c16d67c98c69512342

.exe 72KB

jaffacakes118_Trojan.Win32.Buzus.gzue.7c0228381f07a1c16d67c98c69512342

IMPHASH 5325164daa2d949842ada1293bcd7517
SHA256 7f906e7d421f9aef3f4a2edffde1507f916f7b1ff84c49dfbe7f7749091af564
MD5 7c0228381f07a1c16d67c98c69512342
SHA1 49b939c63f8e1c909c46ba1bc08900da81b3b865
SHA512 21b00220e626f02cd8a39ab23ea12565a0165556a806f836f7ab5a99ee9b8a34e80f5ac280e4599cde12048dc41979e8f3895b36e60a9347f1e62fbf9fa38963
SSDEEP 768:PbcfdQAB0/601ARtO4SYjWwuDmYJbLSjmtpUD477t3eu4iaTUOGbFAA48jSES+Vf:EaAe/ATOSjWTDmALSCPPt2KFA8jQIz
TLSH
T17B739E1E736CA4B7F16D81B5C842D47854693C363A8D8C4BE24FBB592DB8804B6B072B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5128

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

_CIcos _adj_fptan __vbaVarMove __vbaVarVargNofree __vbaFreeVar __vbaAryMove __vbaLenBstr __vbaStrVarMove __vbaFreeVarList _adj_fdiv_m64 ord516 _adj_fprem1 __vbaRecAnsiToUni __vbaStrCat __vbaLsetFixstr __vbaSetSystemError __vbaHresultCheckObj _adj_fdiv_m32 __vbaAryDestruct __vbaOnError _adj_fdiv_m16i _adj_fdivr_m16i _CIsin __vbaErase ord631 __vbaVarZero __vbaChkstk ord526 __vbaFileClose __vbaGenerateBoundsError __vbaStrCmp __vbaAryConstruct2 __vbaGet4 DllFunctionCall __vbaLbound __vbaRedimPreserve _adj_fpatan __vbaFixstrConstruct __vbaRedim __vbaRecUniToAnsi _CIsqrt __vbaExceptHandler __vbaStrToUnicode _adj_fprem _adj_fdivr_m64 ord608 __vbaFPException ord717 __vbaUbound ord644 _CIlog __vbaFileOpen __vbaNew2 __vbaInStr __vbaVar2Vec _adj_fdiv_m32i _adj_fdivr_m32i __vbaStrCopy __vbaFreeStrList __vbaDerefAry1 _adj_fdivr_m32 _adj_fdiv_r ord578 ord100 __vbaVarAdd __vbaAryLock __vbaStrToAnsi __vbaFpI2 __vbaFpI4 ord616 _CIatan __vbaAryCopy __vbaStrMove _allmul _CItan __vbaAryUnlock _CIexp __vbaI4ErrVar __vbaFreeObj __vbaFreeStr ord581

Sharing