f6b3be661dac430bea5c5fcf06663577_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f6b3be661dac430bea5c5fcf06663577_JaffaCakes118
Size

208KB
MD5

f6b3be661dac430bea5c5fcf06663577
SHA1

85142a69f824f58b2c4ea08dac90fddc5f100966
SHA256

a1655f1565117e56628e6a71524c07577eb859a91214b66952f676cd716bf62f
SHA512

67967c72a97324817cbf6beea7a29e9df07ed23f89d3aec1e2d21a784461fdf5e49a55058c577a6eb52695a21af266a8740a91a07caa208b4527fc24cca1b105
SSDEEP

6144:uUeaSmyCTcdOjg5zUxrBcIux6MtQCKmy:uUBSehzxrBcIucGQmy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f6b3be661dac430bea5c5fcf06663577_JaffaCakes118

Files

f6b3be661dac430bea5c5fcf06663577_JaffaCakes118
.dll windows:4 windows x86 arch:x86

52f9d47342bf693c8a63de436f2a57db

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

ws2_32

gethostbyname

ole32

CoTaskMemRealloc

wininet

InternetOpenA

urlmon

URLDownloadToFileA

user32

GetForegroundWindow

gdi32

CreateRectRgn

advapi32

RegOpenKeyA

oleaut32

SysAllocString

Exports

Exports

Always
CallByControl
Downing
GetPlayerVersion
KingS
Stop
playAds

Sections

.text
Size: 197KB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE