318598cde3366d9a7bc3739bffed8469_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

318598cde3366d9a7bc3739bffed8469_JaffaCakes118
Size

188KB
MD5

318598cde3366d9a7bc3739bffed8469
SHA1

3b2445919f2c94670ef8bb8dcabebbef3a2986cf
SHA256

d2de6ff56f36cf3fbd111df17b067c1dcfeb0259712444bfc8f8d8e5a65e1ae5
SHA512

815424dac492044f34a69bf58750c42c8219da0ac95de001f6c55b6fd4b7394d76a78042c77fb652fb9e07759109e9b0038770b0943e41801a53af19a10271fa
SSDEEP

3072:KUlTi//fdgiuXvlvbKv9F982Qrp0c/J0K8IqPu5HQojbSL0DouaDu4FJsTaT3b3v:KU1i//fW/N+vz98RCNOCu8zeAyq+xOj+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
318598cde3366d9a7bc3739bffed8469_JaffaCakes118

Files

318598cde3366d9a7bc3739bffed8469_JaffaCakes118
.dll windows:4 windows x86 arch:x86

39176ffaed968e7259edb776184268cf

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\_cs02200215\es-main-build\plugins\bin\CreativeProjects.pdb

Imports

vistadb.esx

?Instance@AtlasManager@@SAPAV1@XZ
?Create@AtlasManager@@QAE?AV?$shared_ptr@VpjObject@@@boost@@PBDW4DBassetTypes@AtlasUser@@AAJ@Z

mfc80

ord2415
ord2392
ord2396
ord2398
ord2400
ord2390
ord5233
ord5235
ord764
ord876
ord578
ord2272
ord310
ord297
ord2325
ord304
ord781
ord5403
ord2468
ord2902
ord5563
ord5529
ord3997
ord4081
ord3934
ord784
ord266
ord1489
ord6118
ord299
ord6703
ord1482
ord762
ord911
ord2322
ord1084
ord265
ord6754
ord3210
ord1934
ord2368
ord3204
ord6090
ord3761
ord1280
ord5833
ord6067
ord4125
ord1554
ord2372
ord1063
ord314
ord2403
ord1098
ord371
ord1175
ord3684
ord620
ord6725
ord5915
ord1620
ord1617
ord3946
ord1402
ord4244
ord5152
ord1908
ord5073
ord6275
ord4185
ord3403
ord4722
ord4282
ord1600
ord5960
ord923
ord928
ord932
ord930
ord934
ord2410
ord2394
ord2413
ord2408
ord2385
ord2387
ord2405
ord2178
ord2172
ord1522
ord6279
ord3802
ord6277
ord3345
ord4967
ord1362
ord1964
ord1656
ord1655
ord1599
ord5200
ord2537
ord2731
ord2835
ord4307
ord2714
ord2862
ord2540
ord2646
ord2533
ord3718
ord3719
ord3709
ord2644
ord3949
ord4486
ord4261
ord3195
ord572
ord1903
ord5214
ord4108
ord780
ord295
ord2469
ord4035

msvcr80

_initterm_e
_initterm
_encoded_null
_malloc_crt
?terminate@@YAXXZ
_amsg_exit
_onexit
_lock
__dllonexit
_encode_pointer
_unlock
_except_handler4_common
_adjust_fdiv
__CppXcptFilter
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_decode_pointer
_crt_debugger_hook
_mbslen
__CxxFrameHandler3
memset
memcpy
_invalid_parameter_noinfo
??0exception@std@@QAE@ABQBD@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
_purecall
_CxxThrowException
sscanf
??0exception@std@@QAE@ABV01@@Z
??8type_info@@QBE_NABV0@@Z
free
malloc
?raw_name@type_info@@QBEPBDXZ
_mbsnbcpy
__RTDynamicCast
_splitpath
?_name_internal_method@type_info@@QBEPBDPAU__type_info_node@@@Z
__clean_type_info_names_internal

kernel32

FreeLibrary
GetACP
GetSystemTimeAsFileTime
GetTickCount
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
MultiByteToWideChar
lstrlenW
WideCharToMultiByte
lstrcmpiA
GetLocaleInfoA
TlsGetValue
TlsSetValue
UnmapViewOfFile
TlsAlloc
GetSystemInfo
GlobalLock
GlobalUnlock
DeleteFileA
GetFileSize
QueryPerformanceCounter
CreateMutexA
ReleaseMutex
DeleteCriticalSection
InitializeCriticalSection
GlobalAlloc
GetCurrentProcessId
OpenFileMappingA
CreateFileMappingA
MapViewOfFile
GetCurrentProcess
InterlockedDecrement
lstrlenA
FindNextFileA
Sleep
LocalFree
InterlockedIncrement
ReadFile
LoadLibraryA
GetProcAddress
GetThreadLocale
GlobalFree
GetCurrentThreadId
LeaveCriticalSection
EnterCriticalSection
GetLastError
GetProcessHeap
HeapAlloc
FindFirstFileA
FindClose
WaitForSingleObject
GetVersionExA
CreateFileA
SetFilePointer
WriteFile
CloseHandle
OutputDebugStringA
InterlockedExchange
InterlockedCompareExchange

user32

DrawTextA
SendMessageA
InflateRect
GetDC
ReleaseDC
OffsetRect
SetCursor
IsRectEmpty
LoadCursorA
DispatchMessageA
TranslateMessage
PeekMessageA
wvsprintfA
wsprintfA
LoadImageA
CopyRect
PtInRect
EnableWindow
FillRect
GetCapture

gdi32

CreateRectRgn
CreateDIBSection
CreateSolidBrush
GetStockObject
GdiFlush
SetBkMode
CreateCompatibleDC
CreateCompatibleBitmap
SetWindowOrgEx
SetStretchBltMode
BitBlt
SelectClipRgn
DeleteDC
SetTextColor
SelectObject
CreateFontIndirectA
GetDeviceCaps
DPtoLP
GetObjectA
DeleteObject

advapi32

InitializeSecurityDescriptor
RegQueryValueExA
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
RegCloseKey
SetSecurityDescriptorDacl

shlwapi

PathFileExistsA
PathAppendA
PathStripPathA
PathCombineA
PathAppendW
PathFindFileNameA

ole32

CoTaskMemAlloc
CoTaskMemFree
CLSIDFromString
OleRun
CoCreateInstance
CLSIDFromProgID

oleaut32

SysAllocString
SysFreeString
VariantClear
SysStringLen
VariantInit
VariantChangeType
GetErrorInfo

msvcp80

??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z

Exports

Exports

??0AddressObject@@QAE@XZ
??1AddressObject@@UAE@XZ
??_7AddressObject@@6B@
?Construct@AddressObject@@QAE?AW4SUPPORTS_ERRORS@@V?$shared_ptr@VBinaryInterface@@@boost@@@Z
?GetAsciiType@AddressObject@@UAE?AVSystemString@@XZ
GetFactoryV2

Sections

.text
Size: 116KB - Virtual size: 113KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

39176ffaed968e7259edb776184268cf

Headers

File Characteristics

PDB Paths

Imports

vistadb.esx

mfc80

msvcr80

kernel32

user32

gdi32

advapi32

shlwapi

ole32

oleaut32

msvcp80

Exports

Exports

Sections

.text Size: 116KB - Virtual size: 113KB

.rdata Size: 28KB - Virtual size: 27KB

.data Size: 8KB - Virtual size: 7KB

.rsrc Size: 8KB - Virtual size: 4KB

.reloc Size: 24KB - Virtual size: 20KB

.text
Size: 116KB - Virtual size: 113KB

.rdata
Size: 28KB - Virtual size: 27KB

.data
Size: 8KB - Virtual size: 7KB

.rsrc
Size: 8KB - Virtual size: 4KB

.reloc
Size: 24KB - Virtual size: 20KB