facabdc30ccd137b7faa8a416d766cf4_JaffaCakes118

General

Target

facabdc30ccd137b7faa8a416d766cf4_JaffaCakes118
Size

248KB
MD5

facabdc30ccd137b7faa8a416d766cf4
SHA1

89a2bd6df4d294d3708f4cd8ddadf2e3615979c0
SHA256

be8fcdff09ff942c85a3a2c8e2c5b250e684e348f2d0a11253887a5efeea87d8
SHA512

59817243ea780dc9497d49abf80d01e188adac7cff0772d2ab7ab73baeb0f4e99b95077ce8cdd4118adc51c1d7566fba6355d2938eb0ecd18e9ef810d4b168cd
SSDEEP

6144:kYXBux5dX/MRsSkFpYwCS7MKI8jPR7/R98:k4Bm5dTSBS3jJ7g

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
facabdc30ccd137b7faa8a416d766cf4_JaffaCakes118

Files

facabdc30ccd137b7faa8a416d766cf4_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f75fc94e28107e5dd000c0155aba4c9a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Tiwabe\Rahozok.pdb

Imports

comdlg32

GetOpenFileNameA
GetSaveFileNameA
CommDlgExtendedError
ChooseFontA
GetFileTitleA

comctl32

ImageList_DragEnter
ImageList_DragLeave
ImageList_DragShowNolock
ImageList_ReplaceIcon

kernel32

GetSystemInfo
CloseHandle
GetLocaleInfoW
CompareStringW
SetEnvironmentVariableA
HeapDestroy
GetLogicalDriveStringsA
WriteConsoleA
VirtualProtect
GetSystemTimeAsFileTime
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersionExA
WideCharToMultiByte
GetTimeZoneInformation
HeapAlloc
ExitProcess
GetProcAddress
TerminateProcess
GetCurrentProcess
WriteFile
GetStdHandle
GetModuleFileNameA
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetLastError
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
TlsAlloc
SetLastError
GetCurrentThreadId
GetCurrentThread
TlsFree
TlsSetValue
TlsGetValue
HeapCreate
VirtualFree
HeapFree
SetFilePointer
EnterCriticalSection
LeaveCriticalSection
FatalAppExitA
RtlUnwind
VirtualAlloc
HeapReAlloc
IsBadWritePtr
LoadLibraryA
GetACP
GetOEMCP
GetCPInfo
InitializeCriticalSection
InterlockedExchange
VirtualQuery
SetStdHandle
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
HeapSize
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
FlushFileBuffers
SetConsoleCtrlHandler
CompareStringA

Sections

.text
Size: 88KB - Virtual size: 87KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 96KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 60KB - Virtual size: 202KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

f75fc94e28107e5dd000c0155aba4c9a

Headers

File Characteristics

PDB Paths

Imports

comdlg32

comctl32

kernel32

Sections

.text Size: 88KB - Virtual size: 87KB

.rdata Size: 96KB - Virtual size: 94KB

.data Size: 60KB - Virtual size: 202KB

.text
Size: 88KB - Virtual size: 87KB

.rdata
Size: 96KB - Virtual size: 94KB

.data
Size: 60KB - Virtual size: 202KB