48ee9bae1de9cb6cee988444d5cc290a_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

48ee9bae1de9cb6cee988444d5cc290a_JaffaCakes118
Size

484KB
MD5

48ee9bae1de9cb6cee988444d5cc290a
SHA1

6b8843f4c83610b838b661bb66f5b8f57cb48317
SHA256

f15d8a42e02a262894a7854b0a72424482024ee96069d5dbd7f83046403d80f2
SHA512

b7df678dffde44a19efe57091da9e94e4299dcb1412d2df866fd0d7bfbfa007ffb63d1cd668fe3d45f67e477cb3345d5d71463ab907c45bfeb1ade7496ee61c1
SSDEEP

12288:gNFWn/YRTgjIa5oYbtQ0Gr+Q078DTg19bvarmW:g2n/2la5oYbtNGbTg19bSP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
48ee9bae1de9cb6cee988444d5cc290a_JaffaCakes118

Files

48ee9bae1de9cb6cee988444d5cc290a_JaffaCakes118
.dll windows:5 windows x86 arch:x86

275ed4961fa54bcd099ecd78dc9114d1

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

sqlsrv32.pdb

Imports

msvcrt

_adjust_fdiv
_initterm
towlower
towupper
ctime
_wcslwr
_stricmp
_wtoi
qsort
wcscspn
wcsncat
_wcsupr
memmove
_wmakepath
wcsstr
wcschr
_gcvt
modf
time
localtime
_ultoa
_ftol
_ecvt
strchr
_strrev
_wtol
iswctype
_ltow
wcsncmp
_itow
_wcsnicmp
_itoa
_ltoa
atoi
_errno
strerror
_snprintf
_ismbcspace
_except_handler3
atol
isalpha
strstr
_strnicmp
malloc
free
_snwprintf
wcsncpy
strncmp
sprintf
strncpy
_ultow
_wsplitpath
wcscmp
wcscpy
wcsrchr
wcscat
swprintf
_wcsicmp
wcslen

sqlunirl

_GetWindowText@12
_PostMessage@16
_SetWindowLong@12
_GetSaveFileName@4
_GetWindowTextLength@4
_GetDlgItemText@16
_SetDlgItemText@12
_SendDlgItemMessage@20
_GetWindowLong@8
_LoadCursor@8
_MAKEINTRESOURCE@4
_GetUnicodeRedirectionLayer@0
_MessageBox@16
_GetUserName@8
_GetComputerName@8
_CreateFile@28
_LoadLibrary@4
_GetModuleFileName@12
_LoadString@16
_FindResource@12
_SendMessage@16
_SetWindowText@8

kernel32

GetVersionExA
QueryPerformanceCounter
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
CreateFileMappingA
HeapReAlloc
HeapAlloc
OutputDebugStringA
lstrlenA
SearchPathA
GetDriveTypeA
GetFullPathNameA
ExpandEnvironmentStringsA
lstrcpynA
IsBadCodePtr
WaitForSingleObject
WideCharToMultiByte
GetCPInfo
SetLastError
MultiByteToWideChar
FindResourceA
LockResource
FreeResource
InterlockedIncrement
LoadResource
SizeofResource
OpenFile
LoadLibraryA
GetModuleFileNameA
OpenFileMappingA
LocalAlloc
LocalFree
GetComputerNameA
GlobalMemoryStatus
GetDiskFreeSpaceA
GetVersionExW
DeviceIoControl
GetSystemDirectoryA
CreateFileA
MoveFileExA
LocalLock
LocalUnlock
GetModuleHandleA
VerLanguageNameW
GetSystemDefaultLCID
HeapCreate
InitializeCriticalSection
DeleteCriticalSection
HeapDestroy
GetDateFormatA
GetTimeFormatA
GetCurrencyFormatA
GetNumberFormatA
InterlockedExchange
HeapSize
GetLocaleInfoA
MapViewOfFile
GetACP
IsDBCSLeadByteEx
SetUnhandledExceptionFilter
UnmapViewOfFile
CloseHandle
GetOEMCP
SetFilePointer
WriteFile
GetProcessHeap
HeapFree
SetEvent
LeaveCriticalSection
EnterCriticalSection
FreeLibrary
GetProcAddress
GetLastError
SetErrorMode
GetUserDefaultLCID
GetTimeZoneInformation
GetCurrentProcessId
Sleep
GetTickCount
GetCurrentThreadId
GetFileSize
ReadFile

user32

ReleaseCapture
GetDesktopWindow
SetCapture
SetFocus
CheckDlgButton
ShowWindow
GetDlgItem
EnableWindow
IsDlgButtonChecked
MoveWindow
GetSystemMetrics
IsWindowVisible
GetWindowRect
GetParent
EndDialog
UpdateWindow
PostMessageA
IsWindowEnabled
CharToOemBuffA
OemToCharBuffA
MessageBoxA
wsprintfA
CharToOemA
LoadStringA
SetCursor

advapi32

AllocateAndInitializeSid
RegOpenKeyExA
RegCreateKeyExA
RegDeleteKeyA
DeregisterEventSource
FreeSid
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AllocateLocallyUniqueId
RegSetValueExA
RegQueryValueExA
RegCloseKey
GetLengthSid
InitializeAcl
AddAccessDeniedAce
AddAccessAllowedAce

oleaut32

VarR8FromStr

netapi32

Netbios

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

Exports

Exports

BCP_batch
BCP_bind
BCP_colfmt
BCP_collen
BCP_colptr
BCP_columns
BCP_control
BCP_done
BCP_exec
BCP_getcolfmt
BCP_init
BCP_moretext
BCP_readfmt
BCP_sendrow
BCP_setcolfmt
BCP_writefmt
ConfigDSNW
ConfigDriverW
ConnectDlgProc
FinishDlgProc
LibMain
SQLAllocHandle
SQLBindCol
SQLBindParameter
SQLBrowseConnectW
SQLBulkOperations
SQLCancel
SQLCloseCursor
SQLColAttributeW
SQLColumnPrivilegesW
SQLColumnsW
SQLConnectW
SQLCopyDesc
SQLDebug
SQLDescribeColW
SQLDescribeParam
SQLDisconnect
SQLDriverConnectW
SQLEndTran
SQLExecDirectW
SQLExecute
SQLExtendedFetch
SQLFetch
SQLFetchScroll
SQLForeignKeysW
SQLFreeHandle
SQLFreeStmt
SQLGetConnectAttrW
SQLGetConnectOptionW
SQLGetCursorNameW
SQLGetData
SQLGetDescFieldW
SQLGetDescRecW
SQLGetDiagFieldW
SQLGetDiagRecW
SQLGetEnvAttr
SQLGetFunctions
SQLGetInfoW
SQLGetStmtAttrW
SQLGetTypeInfoW
SQLMoreResults
SQLNativeSqlW
SQLNumParams
SQLNumResultCols
SQLParamData
SQLParamOptions
SQLPrepareW
SQLPrimaryKeysW
SQLProcedureColumnsW
SQLProceduresW
SQLPutData
SQLRowCount
SQLSetConnectAttrW
SQLSetConnectOptionW
SQLSetCursorNameW
SQLSetDescFieldW
SQLSetDescRec
SQLSetEnvAttr
SQLSetPos
SQLSetScrollOptions
SQLSetStmtAttrW
SQLSpecialColumnsW
SQLStatisticsW
SQLTablePrivilegesW
SQLTablesW
TestDlgProc
WizDSNDlgProc
WizDatabaseDlgProc
WizIntSecurityDlgProc
WizLanguageDlgProc

Sections

.text
Size: 388KB - Virtual size: 387KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sdbid
Size: 56KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

275ed4961fa54bcd099ecd78dc9114d1

Headers

File Characteristics

PDB Paths

Imports

msvcrt

sqlunirl

kernel32

user32

advapi32

oleaut32

netapi32

version

Exports

Exports

Sections

.text Size: 388KB - Virtual size: 387KB

.data Size: 20KB - Virtual size: 17KB

.sdbid Size: 56KB - Virtual size: 52KB

.rsrc Size: 4KB - Virtual size: 992B

.reloc Size: 12KB - Virtual size: 10KB

.text
Size: 388KB - Virtual size: 387KB

.data
Size: 20KB - Virtual size: 17KB

.sdbid
Size: 56KB - Virtual size: 52KB

.rsrc
Size: 4KB - Virtual size: 992B

.reloc
Size: 12KB - Virtual size: 10KB