jaffacakes118_Trojan[.]Win32[.]Inject[.]wivj[.]0c14cf3e17ad5f354ba65c54199283f3

General

Target
jaffacakes118_Trojan.Win32.Inject.wivj.0c14cf3e17ad5f354ba65c54199283f3
Size 484KB
Sample261018-vsqefasvbs
SHA256 56226fa4a06623d04c1ae3e90abf4235614797ba8fb9f309fab33b4f45fb2e69
MD5 0c14cf3e17ad5f354ba65c54199283f3
SHA1 0527b94f21a73b1025287fdafb733176fb07f9f8
SHA512 cb8b7d45dcb87998c19fb432c20ff63bf3f01aa14a358d436e96d6e5d2424e84060c76dbd590d7ca1133cd1ec785d22b8cc862372c6f5ac0fb58db2d4d46ec28
SSDEEP 12288:nmcnJ/dOHPPL7OPLwGYvnouYfKtFuPZc26:5Y8W
TLSH
T179B4851B9E546134FE6F883478146DABDC181B3A0F487C19EBC157CA78B179392F4A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan.Win32.Inject.wivj.0c14cf3e17ad5f354ba65c54199283f3

File Explorer

jaffacakes118_Trojan.Win32.Inject.wivj.0c14cf3e17ad5f354ba65c54199283f3

.exe 484KB

jaffacakes118_Trojan.Win32.Inject.wivj.0c14cf3e17ad5f354ba65c54199283f3

IMPHASH 244b29800d899d431cba1d421dc0603e
SHA256 56226fa4a06623d04c1ae3e90abf4235614797ba8fb9f309fab33b4f45fb2e69
MD5 0c14cf3e17ad5f354ba65c54199283f3
SHA1 0527b94f21a73b1025287fdafb733176fb07f9f8
SHA512 cb8b7d45dcb87998c19fb432c20ff63bf3f01aa14a358d436e96d6e5d2424e84060c76dbd590d7ca1133cd1ec785d22b8cc862372c6f5ac0fb58db2d4d46ec28
SSDEEP 12288:nmcnJ/dOHPPL7OPLwGYvnouYfKtFuPZc26:5Y8W
TLSH
T179B4851B9E546134FE6F883478146DABDC181B3A0F487C19EBC157CA78B179392F4A2B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

12960

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

EVENT_SINK_GetIDsOfNames __vbaVarSub __vbaVarTstGt ord690 __vbaStrI2 _CIcos _adj_fptan __vbaStrI4 __vbaVarMove __vbaVarVargNofree __vbaFreeVar __vbaLineInputStr __vbaStrVarMove __vbaLateIdCall __vbaLenBstr __vbaFreeVarList __vbaEnd _adj_fdiv_m64 EVENT_SINK_Invoke __vbaNextEachVar __vbaFreeObjList __vbaVarIndexLoadRef _adj_fprem1 __vbaRecAnsiToUni ord518 __vbaCopyBytes __vbaStrCat __vbaVarCmpNe __vbaBoolErrVar ord553 __vbaSetSystemError __vbaHresultCheckObj __vbaLenVar _adj_fdiv_m32 __vbaAryVar ord666 Zombie_GetTypeInfo __vbaAryDestruct ord591 __vbaVarPow __vbaVarForInit ord593 ord594 __vbaOnError __vbaObjSet _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i ord598 ord520 __vbaFpR8 __vbaBoolVarNull _CIsin ord709 __vbaVarCmpGt __vbaVarZero ord632 __vbaChkstk ord526 __vbaFileClose EVENT_SINK_AddRef ord528 __vbaGenerateBoundsError __vbaStrCmp ord529 __vbaAryConstruct2 __vbaVarTstEq __vbaObjVar __vbaI2I4 DllFunctionCall __vbaVarLateMemSt __vbaVarOr __vbaCastObjVar __vbaStrR4 _adj_fpatan __vbaLateIdCallLd Zombie_GetTypeInfoCount __vbaRedim __vbaStrR8 __vbaRecUniToAnsi EVENT_SINK_Release __vbaNew ord600 _CIsqrt __vbaVarAnd EVENT_SINK_QueryInterface __vbaStrUI1 __vbaVarMul __vbaExceptHandler ord711 ord712 __vbaPrintFile __vbaStrToUnicode _adj_fprem _adj_fdivr_m64 __vbaI2Str ord608 ord716 __vbaFPException __vbaInStrVar ord319 __vbaGetOwner3 __vbaStrVarVal __vbaUbound __vbaVarCat ord535 __vbaI2Var ord645 _CIlog __vbaErrorOverflow __vbaFileOpen ord648 ord570 __vbaNew2 __vbaVarLateMemCallLdRf __vbaInStr __vbaR8Str __vbaVarInt ord571 _adj_fdiv_m32i ord572 _adj_fdivr_m32i __vbaVarSetObj __vbaStrCopy __vbaFreeStrList __vbaVarNot _adj_fdivr_m32 _adj_fdiv_r ord685 ord100 __vbaVarTstNe __vbaVarSetVar __vbaI4Var ord689 __vbaVarCmpEq __vbaLateMemCall __vbaAryLock __vbaVarAdd ord320 __vbaVarDup __vbaStrToAnsi ord321 __vbaFpI2 __vbaVarCopy __vbaVarLateMemCallLd __vbaR8IntI2 ord617 __vbaLateMemCallLd _CIatan ord618 __vbaStrMove __vbaAryCopy __vbaCastObj __vbaForEachVar __vbaR8IntI4 _allmul __vbaLateIdSt ord545 _CItan ord546 __vbaAryUnlock __vbaFPInt __vbaVarForNext _CIexp __vbaFreeObj __vbaFreeStr ord580 ord581

Sharing