06ef4375ae4b14b8070bbff5893c685d_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

06ef4375ae4b14b8070bbff5893c685d_JaffaCakes118
Size

159KB
MD5

06ef4375ae4b14b8070bbff5893c685d
SHA1

168503d7ce455209856de401ac89bdd09ed56e9c
SHA256

ea4354921b795c9e0335c742966243b8fc57e4c5ac1579273a7ba96e3425d042
SHA512

8588fb4d652237fe3da609c31fa8335daba97c44c954780e6e14f9ebb29b6dd4bb6ec07ec6dad710a7937eef81743e5dbbecf0306886364f26401d88f71440bf
SSDEEP

3072:nPhrmljEHfJiUl2zZlcF/mggBOKG/cHn0y/VAZW7QNRGU7m20R7eVi:PhrQgHfJic2VyFiO6n0xe0m2ai

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
06ef4375ae4b14b8070bbff5893c685d_JaffaCakes118

Files

06ef4375ae4b14b8070bbff5893c685d_JaffaCakes118
.dll windows:4 windows x86 arch:x86

6839595a0b22572ca50480bffcb1ff93

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

ws2_32

gethostbyname

ole32

CoTaskMemFree

wininet

InternetOpenA

urlmon

URLDownloadToFileA

user32

PostMessageA

gdi32

GetTextCharsetInfo

advapi32

RegCloseKey

oleaut32

VarUI4FromStr

Exports

Exports

Always
ConfigAd
GetADpop
GetPlayerVersion
HKbolo
HashAd
PlayAb
PrioritPutAd
PutTestSpecial
SetAdOnbk
StandYourad
adefee
heyllow
msnpop
qqadpop
sasa

Sections

.text
Size: 148KB - Virtual size: 640KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE