JaffaCakes118_13a2ebdbf2362673c8b03d1d3632257f

Sharing

Copy URL

Twitter E-mail

General

Target

JaffaCakes118_13a2ebdbf2362673c8b03d1d3632257f
Size

469KB
MD5

13a2ebdbf2362673c8b03d1d3632257f
SHA1

c8a8254219ae9850666ccc7e90f3dbb0ced21b88
SHA256

969c7c2eeabfcde6af5038bb7ff4e8e59ca0116e2b9f27b17830cae7af5f3355
SHA512

13bc232497e4193fbd208080939d5edd49d569cd7a13a260f695aa47586227baa6f5f55559a4e69a92d0b4623b3d359b6c661e81ea2f5b0e8e3d9ca0f69e6767
SSDEEP

12288:rHn6ZDfbQcw/0JJOY/CX3cmTDzQR0LxGa:j6tTQp/Qh/KbHzQR0Lx7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_13a2ebdbf2362673c8b03d1d3632257f

Files

JaffaCakes118_13a2ebdbf2362673c8b03d1d3632257f
.exe windows:5 windows x86 arch:x86

49f967476524422c3b1c521d5dc546a7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\Shaun\documents\visual studio 2010\Projects\cLegion\Debug\cLegion.pdb

Imports

kernel32

ExitThread
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
VirtualAlloc
GetModuleHandleA
OpenProcess
SetFileAttributesA
GetCurrentProcessId
CopyFileA
DeleteFileA
GetDriveTypeA
WaitForSingleObject
CreateThread
GetExitCodeThread
GetTempPathA
WriteFile
CreateFileA
GetModuleFileNameA
Beep
GetSystemDirectoryA
GetCurrentDirectoryA
Sleep
GetTickCount
FindClose
FindNextFileA
FindFirstFileA
FreeConsole
AllocConsole
TerminateThread
SetCurrentDirectoryA
SetEndOfFile
ReadFile
FlushFileBuffers
SetStdHandle
HeapQueryInformation
HeapSize
HeapReAlloc
GetConsoleMode
GetConsoleCP
SetFilePointer
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetLocaleInfoA
CreateToolhelp32Snapshot
Process32First
Process32Next
GetCurrentProcess
GetLastError
GetComputerNameA
CloseHandle
GetStringTypeW
OutputDebugStringW
WriteConsoleW
OutputDebugStringA
LCMapStringW
VirtualQuery
GetProcessHeap
HeapAlloc
HeapFree
HeapDestroy
HeapCreate
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetLocaleInfoW
InterlockedExchange
FreeLibrary
SetConsoleCtrlHandler
FatalAppExitA
CreateFileW
RtlUnwind
ResumeThread
EnterCriticalSection
LeaveCriticalSection
InterlockedIncrement
InterlockedDecrement
DecodePointer
GetProcAddress
GetModuleHandleW
ExitProcess
GetCommandLineA
HeapSetInformation
GetStartupInfoW
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
WideCharToMultiByte
MultiByteToWideChar
RaiseException
lstrlenA
LoadLibraryW
EncodePointer
GetModuleFileNameW
GetACP
GetOEMCP
GetCPInfo
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
GetCurrentThreadId
TlsFree
SetLastError
GetCurrentThread
IsProcessorFeaturePresent
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
HeapValidate
IsBadReadPtr

user32

FindWindowA
CallNextHookEx
DispatchMessageA
TranslateMessage
GetMessageA
UnhookWindowsHookEx
SetWindowsHookExA
SetWindowTextA
ExitWindowsEx
DefWindowProcA
CreateWindowExA
RegisterClassExA
LoadCursorA

advapi32

RegSetValueExA
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyExA

shell32

ShellExecuteA

ws2_32

sendto
select
htons
gethostbyname
inet_addr
socket
inet_ntoa
gethostname
WSACleanup
closesocket
connect
getaddrinfo
WSAStartup
recv
send

wininet

InternetOpenUrlA
InternetOpenA
InternetReadFile

Sections

.textbss
Size: - Virtual size: 175KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 367KB - Virtual size: 366KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 70KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

49f967476524422c3b1c521d5dc546a7

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

ws2_32

wininet

Sections

.textbss Size: - Virtual size: 175KB

.text Size: 367KB - Virtual size: 366KB

.rdata Size: 70KB - Virtual size: 70KB

.data Size: 5KB - Virtual size: 17KB

.idata Size: 5KB - Virtual size: 5KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 17KB - Virtual size: 16KB

.textbss
Size: - Virtual size: 175KB

.text
Size: 367KB - Virtual size: 366KB

.rdata
Size: 70KB - Virtual size: 70KB

.data
Size: 5KB - Virtual size: 17KB

.idata
Size: 5KB - Virtual size: 5KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 17KB - Virtual size: 16KB