65c7e596a360e23e6b92e9f75915e0db_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

65c7e596a360e23e6b92e9f75915e0db_JaffaCakes118
Size

219KB
MD5

65c7e596a360e23e6b92e9f75915e0db
SHA1

384abbb04a20168ca6c77c6322a2616bf8016381
SHA256

730ab0949b6055deae709e5cbb6d2b0cdba536016e5e9fd0ee90e338010e9301
SHA512

85a48606e5da94c56ab0291b4dff20e7c07bfe96a32b290114e2adc3b42aa63dc195ae0ec5bdf848906a083aac4adc968a08dcad2388c153e0db83cd002b065c
SSDEEP

3072:ccoBxcea2M/i3HX99NFmbqkiTdEf/QO/lekCuDhr00TTWo9ZhY6s8Gt3EKJ5FlWn:pmuXoNJmbsd9ylVP5P79ZhIzEK/WLD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
65c7e596a360e23e6b92e9f75915e0db_JaffaCakes118

Files

65c7e596a360e23e6b92e9f75915e0db_JaffaCakes118
.dll windows:4 windows x86 arch:x86

545179dc0cedc718decd99ff2519f29c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

ws2_32

WSACleanup

ole32

CoTaskMemFree

wininet

InternetReadFile

urlmon

URLDownloadToFileA

user32

GetForegroundWindow

gdi32

CombineRgn

advapi32

RegQueryValueExA

shell32

SHGetFolderPathA

oleaut32

SysAllocString

Exports

Exports

Always
CallByControl
FukFunc
GetPlayerVersion
Run
Start
Stop
playAda

Sections

.text
Size: 208KB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE