msdaora.pdb
Static task
static1
Behavioral task
behavioral1
Sample
0db49dae79a345746af9fc06f9202711_JaffaCakes118.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
0db49dae79a345746af9fc06f9202711_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
0db49dae79a345746af9fc06f9202711_JaffaCakes118
-
Size
235KB
-
MD5
0db49dae79a345746af9fc06f9202711
-
SHA1
0e36428c81e6a5c8569ad3269456e0bc11f5f02c
-
SHA256
d78cdf73fc5d34dd919b7a079320e98ce3696932313e20b76200eaad539fad64
-
SHA512
2e478149b32c64d3187cb3b368285aeec9ae5ddadb97c91dfc5a4f093b19ade9f95609ba159a6df6a2051b3d5667d4fa726fdc68d53cfe98c783990bc37460aa
-
SSDEEP
3072:refjLr+XFw30KfUsnDQZ+rp4l9aR8w2spF0ilElXGT0LJrtJx7bL87o5f/1MitgM:e/ZR8w7UilElXGT4x7H8s5goX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0db49dae79a345746af9fc06f9202711_JaffaCakes118
Files
-
0db49dae79a345746af9fc06f9202711_JaffaCakes118.dll regsvr32 windows:5 windows x86 arch:x86
18635b76f8e7d54a16db27e091b42157
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_itow
_wtoi
wcsstr
bsearch
towlower
_ftol
towupper
wcschr
realloc
_wcsnicmp
swprintf
wcscpy
wcslen
wcsncpy
wcsncmp
_wcsicmp
free
_except_handler3
wcscmp
wcscat
_endthreadex
_beginthreadex
_initterm
_adjust_fdiv
_purecall
malloc
_ltow
msdatl3
?GetValLong@CUtlProps2@@QBEJKK@Z
?GetValBool@CUtlProps2@@QBEFKK@Z
?SetPropValue@CUtlProps2@@QAEJPBU_GUID@@KPAUtagVARIANT@@@Z
?SetUPropSetCount@CUtlProps2@@QAEXK@Z
?FillDefaultValues@CUtlProps2@@QAEJK@Z
?GetUPropSetCount@CUtlProps2@@QAEKXZ
?CompareDBIDs@@YAJPBUtagDBID@@0@Z
?GetBuffer@CWString@@QAEPAGH@Z
??4CWString@@QAEABV0@PBE@Z
??ACWString@@QBEGH@Z
??YCWString@@QAEABV0@ABV0@@Z
?Mid@CWString@@QBE?AV1@HH@Z
??0CUtlPropInfo@@QAE@XZ
?SetValString@CUtlProps2@@QAEJKKPBG@Z
?GetValShort@CUtlProps2@@QBEFKK@Z
??1CUtlPropInfo@@UAE@XZ
?FInit@CUtlPropInfo@@QAEJXZ
?GetPropertyInfo@CUtlPropInfo@@QAEJKQBUtagDBPROPIDSET@@PAKPAPAUtagDBPROPINFOSET@@PAPAG@Z
??0CWString@@QAE@PBG@Z
??YCWString@@QAEABV0@G@Z
?IsEmpty@CUtlProps2@@QAEHKK@Z
?GetValString@CUtlProps2@@QAEPBGKK@Z
?W95LoadString@@YAHPAXIPAGH@Z
?W95LoadLibraryEx@@YAPAXPBGPAXK@Z
??0CWString@@QAE@PBE@Z
??0CWString@@QAE@PBD@Z
?LoadResourceDLL@@YAJPAG0PAXPAPAX@Z
?OnUnicodeSystem@@YAHXZ
?RegisterServer@@YAJQAX0KQBUtagREGENTRIES@@@Z
??4CWString@@QAEABV0@PBD@Z
?UnRegisterServer@@YAJQAXKQBUtagREGENTRIES@@@Z
?SetCombinedPassThrough@CUtlProps2@@UAEJPBUtagDBPROPSET@@K@Z
??1CSlotListShort@@UAE@XZ
??0CSlotListShort@@QAE@XZ
??0CVLHeap@@QAE@XZ
?FInit@CVLHeap@@QAEHK@Z
?FInit@CSlotListShort@@UAEHKPAPAVISlotList@@PAPAVIHashTbl@@K@Z
?GetNextSlots@CSlotListShort@@UAGJKKPAK@Z
?ReleaseSlots@CSlotListShort@@UAGKKK@Z
?NoBusySlots@CSlotListShort@@UAGJXZ
?GetRowBuff@CSlotListShort@@UAIPAUtagRowBuff@@K@Z
?IsValidSlot@CSlotListShort@@UAGJK@Z
?RecordInternalUse@CSlotListShort@@UAGXXZ
?ResetBusySlotIteration@CSlotListShort@@UAGXXZ
?NextBusySlot@CSlotListShort@@UAGJPAK@Z
??1CExtBuffer@@QAE@XZ
?CountOfBusySlots@CSlotListShort@@UAGKXZ
?SLSlotCapacity@CSlotListShort@@UAGKXZ
??1CVLHeap@@QAE@XZ
?VLAlloc@CVLHeap@@QAGPAXK@Z
?VLTrueRealloc@CVLHeap@@QAGPAXPAXK@Z
?VLFree@CVLHeap@@QAGXPAX@Z
?SetPropertyInError@CUtlProps2@@QAEXKK@Z
?GetPropOption@CUtlProps2@@QAEKKK@Z
?SetStatus@CUtlProps2@@QAEXKKK@Z
?ClearPropertyInError@CUtlProps2@@QAEXXZ
?GetPropsInErrorPtr@CUtlProps2@@QAEPAKXZ
?CopyPropsInError@CUtlProps2@@QAEXPAK@Z
??1CUtlProps2@@UAE@XZ
?SetPropertiesArgChk@CUtlProps2@@SAJKQBUtagDBPROPSET@@@Z
?SetProperties@CUtlProps2@@QAEJKQBUtagDBPROPSET@@H@Z
?GetPropertiesArgChk@CUtlProps2@@QAEJKQBUtagDBPROPIDSET@@PAKPAPAUtagDBPROPSET@@@Z
?GetProperties@CUtlProps2@@QAEJKQBUtagDBPROPIDSET@@PAKPAPAUtagDBPROPSET@@@Z
??4CWString@@QAEABV0@ABV0@@Z
??0CWString@@QAE@XZ
??4CWString@@QAEABV0@PBG@Z
?ReplaceAt@CWString@@QAEXHHPBGH@Z
?IsEmpty@CWString@@QBEHXZ
?Empty@CWString@@QAEXXZ
?ConcatInPlace@CWString@@QAEXHPBG@Z
??YCWString@@QAEABV0@PBG@Z
?OLEDBGetCharTypeW@@YAHKGPAG@Z
??0CUtlProps2@@QAE@K@Z
?GetUPropValIndex@CUtlProps2@@MAEKKK@Z
?FInit@CUtlProps2@@UAEJPAV1@@Z
?GetIndexofPropSet@CUtlProps2@@UAEJPBU_GUID@@PAK@Z
?GetIndexofPropIdinPropSet@CUtlProps2@@UAEJKKPAK@Z
?SetPassThrough@CUtlProps2@@UAEJPBUtagDBPROPSET@@@Z
?ConflictsWithCurrent@CUtlProps2@@UAEHKKABUtagVARIANT@@@Z
?FIsValidColId@CUtlProps2@@UAEHPAUtagDBPROP@@@Z
??1CBitArray@@QAE@XZ
?GetDWORDOfExtBuffer@CExtBuffer@@QAGKK@Z
?GetLastItemHandle@CExtBuffer@@QAGXAAK@Z
?GetItemOfExtBuffer@CExtBuffer@@QAGXKPAX@Z
?InsertIntoExtBuffer@CExtBuffer@@QAGJPAXAAK@Z
?SetSlot@CBitArray@@QAGJK@Z
?IsSlotSet@CBitArray@@QAGJK@Z
?ResetAllSlots@CBitArray@@QAGXXZ
?DeleteFromExtBuffer@CExtBuffer@@QAGXK@Z
?FInit@CBitArray@@QAGJK@Z
??0CBitArray@@QAE@XZ
?FInit@CExtBuffer@@QAEHKPAXKK@Z
??0CExtBuffer@@QAE@XZ
??BCWString@@QBEPBGXZ
?GetLength@CWString@@QBEHXZ
??1CWString@@QAE@XZ
?FoundError@CWString@@QBEHXZ
??0CWString@@QAE@ABV0@@Z
msdart
MpGetHeapHandle
FXMemAttach
FXMemDetach
MPDeleteCriticalSection
MPInitializeCriticalSection
UMSEnterCSWraper
MpHeapFree
MpHeapAlloc
kernel32
DisableThreadLibraryCalls
CompareStringW
CompareStringA
IsDBCSLeadByte
GetModuleFileNameA
HeapDestroy
lstrlenA
GetLastError
GetUserDefaultLCID
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
CreateEventA
ResetEvent
CloseHandle
WideCharToMultiByte
GetCurrentThreadId
SetEvent
WaitForSingleObject
GetProcAddress
GetVersion
FreeLibrary
InterlockedCompareExchange
Sleep
InterlockedExchange
GetVersionExW
VirtualQuery
GetSystemInfo
VirtualAlloc
VirtualProtect
MultiByteToWideChar
InterlockedDecrement
InterlockedIncrement
LeaveCriticalSection
user32
PeekMessageW
TranslateMessage
DispatchMessageW
GetWindowLongA
GetWindowLongW
SetWindowLongA
SetWindowLongW
GetDlgItemTextA
GetDlgItemTextW
SetWindowTextW
EndDialog
SetDlgItemTextA
SetDlgItemTextW
DialogBoxParamA
CharUpperBuffW
CharUpperBuffA
GetCursor
SetCursor
DialogBoxParamW
MsgWaitForMultipleObjects
advapi32
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
ole32
CoCreateInstance
CoGetClassObject
CoGetMalloc
oleaut32
GetErrorInfo
SetErrorInfo
SysFreeString
VarBstrFromR8
VarBstrFromR4
VariantClear
SysAllocString
VariantInit
VariantCopy
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 200KB - Virtual size: 197KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ