d17e7270ec658b807e0f20e85069c0e4_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

d17e7270ec658b807e0f20e85069c0e4_JaffaCakes118
Size

2.9MB
MD5

d17e7270ec658b807e0f20e85069c0e4
SHA1

e34f294b2c053ea84892e3f68295ffd86a87f0a8
SHA256

6113cff5bdb9344b57b3885a794f9547838c22f7e8b060031e87b886fdc66025
SHA512

577666ac1adfb0593456b04d327ba2f10582ce223a1a8b54f59357b551a13f53a6dc0332fc20a7e923452762f221074d5de14aba398b559539d3bf0413484bee
SSDEEP

49152:m2dhj7Kn1wnUvKJLpSApNZ+MJGRTpwJNp/V77nT0dsT+l:7dl7Kn1wnV1MApj+LqJJT0G

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d17e7270ec658b807e0f20e85069c0e4_JaffaCakes118

Files

d17e7270ec658b807e0f20e85069c0e4_JaffaCakes118
.exe windows:4 windows x86 arch:x86

c61122c383e0bb51b07b1f4664706a90

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\Projects\work\Speccy\bin\Speccy.pdb

Imports

setupapi

SetupDiOpenDevRegKey
SetupDiGetDeviceInstanceIdW
SetupDiGetDeviceRegistryPropertyW
SetupDiGetDeviceRegistryPropertyA
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsW

rpcrt4

RpcStringFreeW
UuidToStringW
UuidCreate

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

iphlpapi

GetBestInterface
GetAdaptersInfo

winmm

waveOutGetDevCapsW
waveInMessage
waveInGetDevCapsW
waveInGetNumDevs
waveOutGetNumDevs
waveOutMessage

winhttp

WinHttpOpen
WinHttpQueryOption
WinHttpGetDefaultProxyConfiguration
WinHttpGetIEProxyConfigForCurrentUser
WinHttpCloseHandle

wininet

InternetGetConnectedStateExW

kernel32

MulDiv
HeapCreate
HeapDestroy
HeapAlloc
HeapFree
WritePrivateProfileStringW
GetPrivateProfileStringW
WritePrivateProfileStructW
GetPrivateProfileStructW
CreateFileW
GetProcAddress
GetVersionExW
GetComputerNameW
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
WaitForMultipleObjects
CreateEventW
ReleaseSemaphore
GetTickCount
CreateSemaphoreA
GetSystemDirectoryW
GetTempPathW
WriteFile
DeleteFileW
GetLocaleInfoW
DeviceIoControl
GetFileSize
ReadFile
SetFilePointer
LoadLibraryW
CreateMutexW
GetWindowsDirectoryW
FreeEnvironmentStringsA
IsValidCodePage
GetOEMCP
GetCurrentThread
GetModuleFileNameA
GetStdHandle
FatalAppExitA
GetStringTypeW
GetStringTypeA
GetCPInfo
LCMapStringW
LCMapStringA
RtlUnwind
GetTimeZoneInformation
GetDateFormatA
GetTimeFormatA
GetStartupInfoW
CreateThread
ExitThread
IsDebuggerPresent
UnhandledExceptionFilter
CompareStringW
GetThreadLocale
WideCharToMultiByte
GetACP
HeapSize
HeapReAlloc
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
CreateWaitableTimerA
SetWaitableTimer
SystemTimeToFileTime
ResumeThread
ResetEvent
Sleep
TerminateThread
QueueUserAPC
InterlockedCompareExchange
PostQueuedCompletionStatus
CreateIoCompletionPort
InterlockedExchangeAdd
GetModuleHandleA
InterlockedExchange
GetQueuedCompletionStatus
LocalFree
FormatMessageW
ExitProcess
SetUnhandledExceptionFilter
GetSystemTime
GetTimeFormatW
GetDateFormatW
GetNumberFormatW
GetVersionExA
GlobalMemoryStatus
GetSystemInfo
TlsSetValue
TlsFree
TlsGetValue
TlsAlloc
GetFullPathNameW
FindClose
FindNextFileW
FindFirstFileW
FreeLibrary
GetModuleFileNameW
LeaveCriticalSection
FormatMessageA
SetEnvironmentVariableA
CompareStringA
SetEndOfFile
CreateFileA
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
IsValidLocale
lstrlenA
TerminateProcess
GetProcessHeap
EnumSystemLocalesA
GetUserDefaultLCID
SetConsoleCtrlHandler
FlushFileBuffers
GetConsoleMode
GetConsoleCP
QueryPerformanceCounter
GetStartupInfoA
GetFileType
GetCurrentProcessId
EnterCriticalSection
GetCurrentProcess
CreateMutexA
DeleteCriticalSection
lstrcmpiW
InitializeCriticalSection
FindResourceExW
ReleaseMutex
GetCurrentThreadId
CloseHandle
LockResource
GetLastError
LoadLibraryExW
FindResourceW
GetSystemTimeAsFileTime
LoadResource
GetModuleHandleW
SizeofResource
SetLastError
CreateEventA
lstrlenW
InterlockedDecrement
RaiseException
FlushInstructionCache
InterlockedIncrement
SetEvent
MultiByteToWideChar
WaitForSingleObject
GetLocalTime
GetEnvironmentStrings
SetHandleCount
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
GetLocaleInfoA

user32

SetWindowRgn
MoveWindow
MapDialogRect
CheckRadioButton
DrawTextExW
EmptyClipboard
SetClipboardData
CloseClipboard
DestroyCursor
DrawEdge
UnregisterClassA
IntersectRect
SystemParametersInfoA
IsIconic
GetSysColorBrush
UnhookWindowsHookEx
SetWindowsHookExW
CallNextHookEx
GetMenuItemCount
AppendMenuW
LoadBitmapW
KillTimer
GetClassLongW
SetClassLongW
SetWindowPlacement
GetWindowPlacement
DeleteMenu
DestroyMenu
RedrawWindow
GetMenu
MessageBoxW
SetTimer
GetTopWindow
GetClassInfoExW
GetScrollInfo
SetScrollInfo
ShowScrollBar
InflateRect
GetKeyState
PostMessageW
GetMessageTime
GetDoubleClickTime
IsCharAlphaNumericW
IsWindowVisible
CopyRect
RegisterClassExW
GetMenuBarInfo
PostQuitMessage
EnableMenuItem
EnumDisplayDevicesW
EnumDisplaySettingsExW
MonitorFromPoint
GetMonitorInfoW
OpenClipboard
DialogBoxParamW
DefWindowProcW
GetActiveWindow
DispatchMessageW
TranslateMessage
CreateDialogParamW
GetMessageW
CharNextW
PeekMessageW
DestroyWindow
SetWindowLongW
GetWindowRect
SystemParametersInfoW
SetCapture
GetSystemMetrics
SetMenuItemInfoW
GetDCEx
GetSubMenu
CheckMenuItem
ShowWindow
EnableWindow
IsDlgButtonChecked
GetWindowTextLengthW
SetRectEmpty
GetCapture
MapWindowPoints
ReleaseCapture
DrawTextW
LoadImageW
GetFocus
SetWindowTextW
DrawFocusRect
GetDlgCtrlID
CallWindowProcW
GetClassNameW
GetWindowTextW
BeginPaint
SetWindowPos
SetDlgItemTextW
GetCursorPos
LoadCursorW
ReleaseDC
EndPaint
ScreenToClient
DestroyIcon
GetParent
InvalidateRect
GetDC
SendMessageW
GetDlgItem
EndDialog
GetClientRect
PtInRect
FillRect
SetCursor
OffsetRect
GetWindowLongW
UpdateWindow
CreateWindowExW
GetWindowDC
SetFocus
IsWindow
IsWindowEnabled
GetWindow
GetSysColor

gdi32

ExtTextOutW
SetBkColor
Ellipse
SetTextColor
DeleteDC
SelectObject
GetStockObject
CreatePatternBrush
DeleteObject
GetObjectW
CreateFontIndirectW
SetBkMode
CreateDCW
ExtEscape
CreateSolidBrush
BitBlt
CreatePen
CreateRoundRectRgn
CreateCompatibleDC
SetViewportOrgEx
CreateCompatibleBitmap
GetTextExtentPoint32W
GetBitmapBits
SaveDC
RestoreDC
Rectangle
RoundRect
GetTextMetricsW
MoveToEx
LineTo
SetPixel
Polyline
GetTextExtentExPointW
GetClipBox
GetDCOrgEx
GetBkColor
GetTextColor
TextOutW
GetDeviceCaps
DPtoLP
CreateDIBSection

comdlg32

GetOpenFileNameW
GetSaveFileNameW

advapi32

FreeSid
RegCloseKey
ControlService
StartServiceW
DeleteService
OpenServiceW
OpenSCManagerW
CloseServiceHandle
CreateServiceW
RegCreateKeyW
RegOpenKeyExW
AllocateAndInitializeSid
RegQueryValueExW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
RegEnumKeyExW
RegDeleteKeyW
RegQueryInfoKeyW

shell32

ShellExecuteW
DragQueryFileW
DragFinish
ShellExecuteExW

ole32

PropVariantClear
CoInitializeSecurity
CoInitializeEx
CoTaskMemFree
CoUninitialize
CoInitialize
OleRun
CoTaskMemRealloc
CoCreateInstance
CoTaskMemAlloc

oleaut32

VariantInit
VariantClear
VariantTimeToSystemTime
SystemTimeToVariantTime
VarUdateFromDate
VariantChangeType
SysStringByteLen
VariantCopy
SafeArrayAccessData
SafeArrayGetVartype
SafeArrayGetElemsize
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayUnaccessData
SysAllocString
SysFreeString
VarUI4FromStr
SysAllocStringByteLen
VarBstrFromR8
GetErrorInfo
SetErrorInfo
CreateErrorInfo

shlwapi

StrFormatByteSizeW
PathFileExistsW
PathStripPathW
PathAppendW
PathCombineW
PathFindFileNameA
UrlUnescapeA
PathRemoveFileSpecW

msimg32

TransparentBlt
AlphaBlend

comctl32

InitCommonControlsEx
_TrackMouseEvent

ws2_32

WSAStartup
WSALookupServiceBeginW
getservbyname
htons
WSARecv
setsockopt
WSASocketW
gethostbyname
closesocket
WSAStringToAddressA
connect
WSASend
WSASetLastError
WSACleanup
WSALookupServiceEnd
WSAGetLastError
WSALookupServiceNextW
inet_addr

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 340KB - Virtual size: 338KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 108KB - Virtual size: 118KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

CONST
Size: 4KB - Virtual size: 31B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c61122c383e0bb51b07b1f4664706a90

Headers

File Characteristics

PDB Paths

Imports

setupapi

rpcrt4

version

iphlpapi

winmm

winhttp

wininet

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

msimg32

comctl32

ws2_32

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.rdata Size: 340KB - Virtual size: 338KB

.data Size: 108KB - Virtual size: 118KB

.tls Size: 4KB - Virtual size: 2B

CONST Size: 4KB - Virtual size: 31B

.rsrc Size: 1.1MB - Virtual size: 1.1MB

.text
Size: 1.4MB - Virtual size: 1.4MB

.rdata
Size: 340KB - Virtual size: 338KB

.data
Size: 108KB - Virtual size: 118KB

.tls
Size: 4KB - Virtual size: 2B

CONST
Size: 4KB - Virtual size: 31B

.rsrc
Size: 1.1MB - Virtual size: 1.1MB