jaffacakes118_Trojan[.]Win32[.]Buzus[.]ibdo[.]f8dad3d1e54ca6779f37d1c1ef6bb48a

General

Target
jaffacakes118_Trojan.Win32.Buzus.ibdo.f8dad3d1e54ca6779f37d1c1ef6bb48a
Size 96KB
Sample261018-3pcceabz3x
SHA256 3f2a34f155fcdf8b169e9b599edd9f8a1140a2a5902082e0ad9a7423b44bda3f
MD5 f8dad3d1e54ca6779f37d1c1ef6bb48a
SHA1 9714387b4233dd20fb68777c2307a4f20093f533
SHA512 6a3576ad06f08098e466cbd232ef4e0689e1db89bfb729656188b5d63dad798343ea36cb692cc842754aaa2fa2fcf85d099d6f0b54b9394ddeb006405e9a3b86
SSDEEP 1536:Ho4KzN1hSrpKz3euW6HCsCaY4YiXjWNzVmoKAZUfetMpMMry:HsN1E43eACsCaYZ2ez
TLSH
T1EAA35C23A638A567E5914AB10DB2C6B97A23BC3106828E472485FF4D1D70D03BDB772B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan.Win32.Buzus.ibdo.f8dad3d1e54ca6779f37d1c1ef6bb48a

File Explorer

jaffacakes118_Trojan.Win32.Buzus.ibdo.f8dad3d1e54ca6779f37d1c1ef6bb48a

.exe 96KB

jaffacakes118_Trojan.Win32.Buzus.ibdo.f8dad3d1e54ca6779f37d1c1ef6bb48a

IMPHASH 546eb8276d9fcd45411a09a7240ff889
SHA256 3f2a34f155fcdf8b169e9b599edd9f8a1140a2a5902082e0ad9a7423b44bda3f
MD5 f8dad3d1e54ca6779f37d1c1ef6bb48a
SHA1 9714387b4233dd20fb68777c2307a4f20093f533
SHA512 6a3576ad06f08098e466cbd232ef4e0689e1db89bfb729656188b5d63dad798343ea36cb692cc842754aaa2fa2fcf85d099d6f0b54b9394ddeb006405e9a3b86
SSDEEP 1536:Ho4KzN1hSrpKz3euW6HCsCaY4YiXjWNzVmoKAZUfetMpMMry:HsN1E43eACsCaYZ2ez
TLSH
T1EAA35C23A638A567E5914AB10DB2C6B97A23BC3106828E472485FF4D1D70D03BDB772B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

6436

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

EVENT_SINK_GetIDsOfNames _CIcos _adj_fptan __vbaVarVargNofree __vbaFreeVar __vbaAryMove ord588 __vbaLenBstr __vbaStrVarMove __vbaLateIdCall __vbaFreeVarList __vbaPut3 _adj_fdiv_m64 EVENT_SINK_Invoke __vbaRaiseEvent __vbaFreeObjList ord517 _adj_fprem1 __vbaI2Abs __vbaStrCat __vbaSetSystemError __vbaHresultCheckObj _adj_fdiv_m32 Zombie_GetTypeInfo __vbaAryDestruct __vbaForEachCollObj __vbaExitProc __vbaVarForInit __vbaOnError __vbaObjSet ord595 _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i ord598 ord599 __vbaBoolVar __vbaBoolVarNull _CIsin ord631 __vbaErase __vbaNextEachCollObj ord632 __vbaChkstk ord526 __vbaFileClose EVENT_SINK_AddRef __vbaGenerateBoundsError __vbaStrCmp __vbaGet3 __vbaPutOwner3 __vbaObjVar __vbaI2I4 DllFunctionCall __vbaFpUI1 __vbaCastObjVar __vbaRedimPreserve _adj_fpatan __vbaLateIdCallLd Zombie_GetTypeInfoCount __vbaRedim EVENT_SINK_Release __vbaUI1I2 _CIsqrt EVENT_SINK_QueryInterface __vbaExceptHandler __vbaStrToUnicode ord712 ord713 _adj_fprem _adj_fdivr_m64 ord608 __vbaFPException ord319 __vbaStrVarVal __vbaUbound __vbaVarCat __vbaCheckType ord644 ord645 _CIlog __vbaErrorOverflow __vbaFileOpen ord648 ord570 __vbaInStr __vbaVar2Vec __vbaNew2 _adj_fdiv_m32i _adj_fdivr_m32i __vbaStrCopy ord681 __vbaFreeStrList _adj_fdivr_m32 _adj_fdiv_r ord100 __vbaI4Var __vbaAryLock ord320 __vbaStrToAnsi __vbaVarDup ord321 __vbaFpI2 __vbaFpI4 __vbaVarCopy __vbaLateMemCallLd _CIatan __vbaCastObj __vbaStrMove _allmul __vbaLateIdSt _CItan __vbaAryUnlock __vbaVarForNext _CIexp __vbaFreeStr __vbaFreeObj ord581

Sharing