63148d4b87ab8be629219f3d4db650f3_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

63148d4b87ab8be629219f3d4db650f3_JaffaCakes118
Size

252KB
MD5

63148d4b87ab8be629219f3d4db650f3
SHA1

e3faf5554b879499207247c63b65a82d192bc67d
SHA256

1048872e907c592fbcabb6a67a1307b1348e8b5d8e848fe46779ac020be29fcf
SHA512

e19c8a7493b7ab7b1291533b79c3111577602934daaf1117f179f85bc6e92cc2145ad4499cec98354d494930cb88ea87b19c01b964bdf9427863f39671584bbb
SSDEEP

6144:5n56Ll8TxJLCjljW+xLyaUFla26qg3esAnQ:5ml8Tvujx9HUF16qOyQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
63148d4b87ab8be629219f3d4db650f3_JaffaCakes118

Files

63148d4b87ab8be629219f3d4db650f3_JaffaCakes118
.dll windows:4 windows x86 arch:x86

55567b547961b1c83fe15fb43264ed0c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

ws2_32

gethostbyname

ole32

CoTaskMemFree

wininet

InternetOpenA

urlmon

URLDownloadToFileA

user32

PostMessageA

gdi32

CreateSolidBrush

advapi32

RegCloseKey

oleaut32

VarUI4FromStr

Exports

Exports

Always
ConfigAd
GetADpop
GetPlayerVersion
HKbolo
HashAd
PlayAb
PrioritPutAd
PutTestSpecial
SetAdOnbk
StandYourad
adefee
heyllow
msnpop
qqadpop
sasa

Sections

.text
Size: 148KB - Virtual size: 640KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 6KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE