27dfadc98202c4b4ad1b7effc632d157_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

27dfadc98202c4b4ad1b7effc632d157_JaffaCakes118
Size

211KB
MD5

27dfadc98202c4b4ad1b7effc632d157
SHA1

4a9f7069c4ad7bd84f70c99a1e44e0c437730466
SHA256

d50ee39d00e640b5866f4bb77ee236bfe9b32eaead509efd3e9d80a3193eee40
SHA512

4e79d58e4f8630bcc93b7d2c20ef8d269e892c4cf2b45255a01d252854653a2137e5687b1c0a73fa926475a76253753294d7559a1b43174535e4a50e83d9a5bc
SSDEEP

6144:06V6OFKDPetuRRf7DsiNUueg6aGruvwidAn4thyw:0oFUDPquRRfHeg62Yc3r

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
27dfadc98202c4b4ad1b7effc632d157_JaffaCakes118

Files

27dfadc98202c4b4ad1b7effc632d157_JaffaCakes118
.dll windows:4 windows x86 arch:x86

354aed026eeaf9b59abc4eff038fa72f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

ws2_32

WSACleanup

ole32

CoTaskMemFree

wininet

InternetReadFile

urlmon

URLDownloadToFileA

user32

GetForegroundWindow

gdi32

DeleteObject

advapi32

RegQueryValueExA

shell32

SHGetFolderPathA

oleaut32

SysAllocString

Exports

Exports

Always
DownloadDLL
GetPlayerVersion
KingsStop
KingsUp
_JDIS_DISOSD_S
playAdk

Sections

.text
Size: 201KB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE