jaffacakes118_Trojan[.]Win32[.]Refroso[.]gfpq[.]8bd43bf917d49f9c0e1622ab6f6d7d14

General

Target
jaffacakes118_Trojan.Win32.Refroso.gfpq.8bd43bf917d49f9c0e1622ab6f6d7d14
Size 156KB
Sample261018-stn7nabe76
SHA256 4064379f04fa252413908876ea349890f2432f465f456f40c054409b1047831e
MD5 8bd43bf917d49f9c0e1622ab6f6d7d14
SHA1 f71a40cd3e0125068f23a6fe4f8ab599198f752e
SHA512 5f28f1c7cea0d3787475ac095d5b2248c240a081c8c0abc14cefe9aeddc60e839985e5b81804b0bbee07c7057c7c5a6c22591d21e86a26eeb7856e9541be53cf
SSDEEP 3072:zm5PDyktMOx2hypK7D6zdX3+P+kdMTN5kxFJ:zyuxF
TLSH
T1C3F3713A19BD1227D1B4C6B6CFD68827F018E47B35216D36A8C787994357E4368CB23E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan.Win32.Refroso.gfpq.8bd43bf917d49f9c0e1622ab6f6d7d14

File Explorer

jaffacakes118_Trojan.Win32.Refroso.gfpq.8bd43bf917d49f9c0e1622ab6f6d7d14

.exe 156KB

jaffacakes118_Trojan.Win32.Refroso.gfpq.8bd43bf917d49f9c0e1622ab6f6d7d14

IMPHASH 1b14cc5cd0fa711d323c444639b915f5
SHA256 4064379f04fa252413908876ea349890f2432f465f456f40c054409b1047831e
MD5 8bd43bf917d49f9c0e1622ab6f6d7d14
SHA1 f71a40cd3e0125068f23a6fe4f8ab599198f752e
SHA512 5f28f1c7cea0d3787475ac095d5b2248c240a081c8c0abc14cefe9aeddc60e839985e5b81804b0bbee07c7057c7c5a6c22591d21e86a26eeb7856e9541be53cf
SSDEEP 3072:zm5PDyktMOx2hypK7D6zdX3+P+kdMTN5kxFJ:zyuxF
TLSH
T1C3F3713A19BD1227D1B4C6B6CFD68827F018E47B35216D36A8C787994357E4368CB23E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5100

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

__vbaNextEachAry _CIcos _adj_fptan __vbaVarMove __vbaFreeVar __vbaAryMove __vbaLenBstr __vbaGosubReturn ord696 __vbaFreeVarList _adj_fdiv_m64 __vbaFreeObjList ord516 _adj_fprem1 __vbaRecAnsiToUni ord628 __vbaStrCat __vbaRecDestruct __vbaSetSystemError __vbaLenBstrB __vbaHresultCheckObj _adj_fdiv_m32 __vbaAryVar __vbaAryDestruct _adj_fdiv_m16i _adj_fdivr_m16i ord522 _CIsin __vbaErase ord631 __vbaVarZero __vbaChkstk __vbaGosubFree EVENT_SINK_AddRef __vbaGenerateBoundsError __vbaStrCmp DllFunctionCall _adj_fpatan __vbaRedim __vbaRecUniToAnsi EVENT_SINK_Release __vbaUI1I2 _CIsqrt EVENT_SINK_QueryInterface __vbaExceptHandler ord712 ord606 _adj_fprem _adj_fdivr_m64 __vbaGosub __vbaFPException ord717 __vbaVarCat ord644 _CIlog __vbaErrorOverflow __vbaNew2 __vbaVar2Vec _adj_fdiv_m32i ord572 _adj_fdivr_m32i __vbaStrCopy __vbaI4Str __vbaFreeStrList _adj_fdivr_m32 _adj_fdiv_r ord100 __vbaForEachAry __vbaAryLock __vbaVarDup __vbaAryVarVarg __vbaFpI4 _CIatan __vbaAryCopy __vbaStrMove __vbaUI1Str _allmul _CItan __vbaAryUnlock _CIexp __vbaFreeStr __vbaI4ErrVar

Sharing