jaffacakes118_Worm[.]Win32[.]Vobfus[.]etzm[.]02a0b5b57d8a4472714049f0b36a1598

General

Target
jaffacakes118_Worm.Win32.Vobfus.etzm.02a0b5b57d8a4472714049f0b36a1598
Size 268KB
Sample261018-thfa2sew8j
SHA256 a36c7fab13794fea70545fcb2970dc93352ecca163b5753022e4e275ef3c3a32
MD5 02a0b5b57d8a4472714049f0b36a1598
SHA1 a0949d2bdb0012555aaf6d474ceb078e15d97c2b
SHA512 001d92e72effc6394d4d148e88d3748f720fd28159f667dc670b1fd128d41761600c166a2b7e5fcd0d9591fa38c7a331e101424540afcae35f7d28f6c7918738
SSDEEP 6144:SEwz2Eu+yV2PL9JhCNjKV6MG31luID8NLJTPxhMbmNPjiiSI0:ShMs0Nz8tJTZhMiiN
TLSH
T1D4445051AA50503FF85288F0381BA796BA1E1E7616A0FC07B7D19B9834746E3B6F131F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Worm.Win32.Vobfus.etzm.02a0b5b57d8a4472714049f0b36a1598

File Explorer

jaffacakes118_Worm.Win32.Vobfus.etzm.02a0b5b57d8a4472714049f0b36a1598

.exe 268KB

jaffacakes118_Worm.Win32.Vobfus.etzm.02a0b5b57d8a4472714049f0b36a1598

IMPHASH 7bef983cd22f84b8541c399e84cdac4c
SHA256 a36c7fab13794fea70545fcb2970dc93352ecca163b5753022e4e275ef3c3a32
MD5 02a0b5b57d8a4472714049f0b36a1598
SHA1 a0949d2bdb0012555aaf6d474ceb078e15d97c2b
SHA512 001d92e72effc6394d4d148e88d3748f720fd28159f667dc670b1fd128d41761600c166a2b7e5fcd0d9591fa38c7a331e101424540afcae35f7d28f6c7918738
SSDEEP 6144:SEwz2Eu+yV2PL9JhCNjKV6MG31luID8NLJTPxhMbmNPjiiSI0:ShMs0Nz8tJTZhMiiN
TLSH
T1D4445051AA50503FF85288F0381BA796BA1E1E7616A0FC07B7D19B9834746E3B6F131F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

17236

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

__vbaVarSub __vbaVarTstGt __vbaStrI2 _CIcos _adj_fptan __vbaVarMove __vbaStrI4 __vbaVarVargNofree ord187 ord587 __vbaFreeVar __vbaAryMove __vbaLenBstr __vbaStrVarMove __vbaFreeVarList __vbaPut3 __vbaEnd _adj_fdiv_m64 __vbaPut4 __vbaFreeObjList ord516 ord517 __vbaStrErrVarCopy _adj_fprem1 ord518 __vbaStrCat __vbaSetSystemError __vbaRecDestruct __vbaHresultCheckObj __vbaLenBstrB _adj_fdiv_m32 __vbaAryVar __vbaAryDestruct __vbaVarIndexLoadRefLock ord669 __vbaObjSet __vbaOnError _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i __vbaVarIndexLoad ord520 __vbaStrFixstr __vbaBoolVarNull __vbaFpR8 _CIsin ord709 ord631 __vbaErase ord632 __vbaVarZero __vbaChkstk __vbaFileClose EVENT_SINK_AddRef ord527 __vbaGenerateBoundsError ord528 __vbaStrCmp __vbaGet3 __vbaCyI2 __vbaVarTstEq __vbaAryConstruct2 __vbaPutOwner3 __vbaI2I4 DllFunctionCall __vbaVarOr __vbaRedimPreserve _adj_fpatan __vbaRedim EVENT_SINK_Release __vbaUI1I2 _CIsqrt EVENT_SINK_QueryInterface __vbaVarMul __vbaUI1I4 __vbaFpCmpCy __vbaExceptHandler ord711 ord712 _adj_fprem _adj_fdivr_m64 ord607 ord608 __vbaFPException ord717 __vbaInStrVar __vbaStrVarVal __vbaUbound __vbaVarCat __vbaGetOwner4 ord535 __vbaI2Var ord644 ord537 ord645 _CIlog __vbaErrorOverflow __vbaFileOpen ord648 __vbaVar2Vec __vbaInStr __vbaNew2 __vbaVarInt _adj_fdiv_m32i _adj_fdivr_m32i __vbaStrCopy ord681 __vbaFreeStrList _adj_fdivr_m32 __vbaPowerR8 _adj_fdiv_r ord685 ord578 ord100 ord579 __vbaVarTstNe __vbaI4Var __vbaAryLock __vbaVarAdd __vbaVarDup __vbaFpI2 __vbaVarCopy __vbaFpI4 ord616 ord617 _CIatan __vbaStrMove ord618 __vbaAryCopy ord619 __vbaStrVarCopy _allmul _CItan __vbaFPInt __vbaAryUnlock _CIexp __vbaFreeStr __vbaI4ErrVar __vbaFreeObj

Sharing