19612cb1f4cfd5529827d6138553b943_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

19612cb1f4cfd5529827d6138553b943_JaffaCakes118
Size

776KB
MD5

19612cb1f4cfd5529827d6138553b943
SHA1

e7c985d8e01dab7b798a0fc240e926093e25714d
SHA256

7461c5cc42e20d181f84be0559a3626e5f1a74a4466c9fb90c323d9acd49aacf
SHA512

43849196efca49aae090b0d7c1f4e3512146616d14177997bd1577e3462c0c81f3705f840148868d105f98c899f703e699674376fbf6f549f3d3212a68bfc5b2
SSDEEP

6144:O4l5Kl+rcWz82YSzgDAEEj0IpJWUxAnG8BfE8PcQbOyN1lZsl7bgCQGXlYS1:OsrjgDAENIpJkG8BxPcoOyhZs6mYe

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
19612cb1f4cfd5529827d6138553b943_JaffaCakes118

Files

19612cb1f4cfd5529827d6138553b943_JaffaCakes118
.dll windows:4 windows x86 arch:x86

545179dc0cedc718decd99ff2519f29c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

ws2_32

WSACleanup

ole32

CoTaskMemFree

wininet

InternetReadFile

urlmon

URLDownloadToFileA

user32

GetForegroundWindow

gdi32

CombineRgn

advapi32

RegQueryValueExA

shell32

SHGetFolderPathA

oleaut32

SysAllocString

Exports

Exports

Always
DSDD_YUNJ_DOSS
DownloadDLL
GetPlayerVersion
KingsStop
KingsUp
playAdk

Sections

.text
Size: 199KB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE