171f8ad3125cfa26f4bc4c00be6cfbaa_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

171f8ad3125cfa26f4bc4c00be6cfbaa_JaffaCakes118
Size

1.3MB
MD5

171f8ad3125cfa26f4bc4c00be6cfbaa
SHA1

1088a7cff4b8bc0038a7ba2764982dd79e028fd1
SHA256

1029c307d6976e1375a48d623e0667c3a1648e7babcd310fbe13ba919c14e3f8
SHA512

a72ae5a4a9fbe719fe23f0847fb9e82b0912dd0c8e692b683d90152bd36f1923ac10cf72ebdff016c2aa637bbf9127bdf4e3ebd8f34ecee794faed3a3c0649f0
SSDEEP

24576:2te6Rs4e2LdQSOjUMmHQd5Rtjm7MgzI/HsL/MyhDLXoXzVJXAPzxu:Ss2QSOb5zR/qlLXQp6u

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/M0st^W4nt3d.exe	upx

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/CS1.5多功能最强作弊器1.7版.exe
unpack001/M0st^W4nt3d.dll
unpack001/M0st^W4nt3d.exe

Files

171f8ad3125cfa26f4bc4c00be6cfbaa_JaffaCakes118
.rar
CS1.5多功能最强作弊器1.7版.exe
.exe windows:4 windows x86 arch:x86

5a498eee87e4d89512a84502f500181f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
GetModuleHandleA
LoadLibraryA

Sections

Size: 37KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
DaTa/56k.rx
DaTa/Scriptz.cfg
DaTa/SpeedHack.cfg
DaTa/acn-buybot.cfg
DaTa/adsl.rx
DaTa/cable.rx
DaTa/crash.rx
DaTa/pm-vecs.cfg
DaTa/spaminator.cfg
M0st^W4nt3d.dll
.dll windows:4 windows x86 arch:x86

05926cf042a601491fd83f20ce8e79a3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

VirtualProtect
IsBadWritePtr
IsBadReadPtr
GetProcAddress
GetModuleHandleA
FindNextFileA
DeleteFileA
FindFirstFileA
GetLocalTime
MoveFileA
ExitProcess
GetFullPathNameA
GetCurrentProcessId
DisableThreadLibraryCalls
GetModuleFileNameA
FreeLibrary
LoadLibraryA
CloseHandle
OpenProcess
GetLastError
WriteProcessMemory
VirtualProtectEx
ReadProcessMemory
MapViewOfFile
CreateFileMappingA
GetLocaleInfoW
SetEndOfFile
GetOEMCP
GetACP
CreateFileA
ReadFile
SetStdHandle
IsBadCodePtr
EnterCriticalSection
Sleep
InitializeCriticalSection
InterlockedExchange
DeleteCriticalSection
LeaveCriticalSection
InterlockedDecrement
InterlockedIncrement
WideCharToMultiByte
MultiByteToWideChar
RtlUnwind
RaiseException
GetTimeZoneInformation
GetSystemTime
HeapFree
GetCommandLineA
GetVersion
HeapAlloc
HeapReAlloc
LCMapStringA
LCMapStringW
GetCPInfo
CompareStringA
CompareStringW
TerminateProcess
GetCurrentProcess
HeapSize
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
WriteFile
SetFilePointer
FlushFileBuffers
SetUnhandledExceptionFilter
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
IsValidLocale
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
GetUserDefaultLCID
GetVersionExA
GetStringTypeA
GetStringTypeW
SetEnvironmentVariableA

user32

GetAsyncKeyState
MessageBoxA
GetWindowTextA
FindWindowA
PostMessageA

winmm

timeGetTime
sndPlaySoundA

Sections

.text
Size: 300KB - Virtual size: 297KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
M0st^W4nt3d.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 460KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 212KB - Virtual size: 216KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
M0st^W4nt3d.ini
aimbot.cfg
bind.cfg
bones.cfg
buy.cfg
buybots/akm4.cfg
buybots/awp.cfg
buybots/bestrifle.cfg
buybots/bestweapon.cfg
buybots/bestweapon2.cfg
buybots/bestweapon3.cfg
buybots/economical.cfg
buybots/economical2.cfg
buybots/economical3.cfg
buybots/smg.cfg
commandmenu.txt
cvar.bin
ggg.cfg
init.cfg
main.cfg
menu.cfg
winamp.cfg

Sharing

General

Malware Config

Signatures

Files

5a498eee87e4d89512a84502f500181f

Headers

File Characteristics

Imports

kernel32

Sections

Size: 37KB - Virtual size: 64KB

Size: 512B - Virtual size: 4KB

Size: 3KB - Virtual size: 4KB

05926cf042a601491fd83f20ce8e79a3

Headers

File Characteristics

Imports

kernel32

user32

winmm

Sections

.text Size: 300KB - Virtual size: 297KB

.rdata Size: 32KB - Virtual size: 29KB

.data Size: 24KB - Virtual size: 49KB

.reloc Size: 24KB - Virtual size: 20KB

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 460KB

UPX1 Size: 212KB - Virtual size: 216KB

.rsrc Size: 5KB - Virtual size: 8KB

.text
Size: 300KB - Virtual size: 297KB

.rdata
Size: 32KB - Virtual size: 29KB

.data
Size: 24KB - Virtual size: 49KB

.reloc
Size: 24KB - Virtual size: 20KB

UPX0
Size: - Virtual size: 460KB

UPX1
Size: 212KB - Virtual size: 216KB

.rsrc
Size: 5KB - Virtual size: 8KB