7363384de63aeb2d44db51c70a164ad6_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

7363384de63aeb2d44db51c70a164ad6_JaffaCakes118
Size

214KB
MD5

7363384de63aeb2d44db51c70a164ad6
SHA1

c5756de9668e6197631dc15b0c58807bb38446d0
SHA256

490cdd67d81adb94a4d318f95c16e3838b865c6da3332de6697a1fd980de2991
SHA512

bdf8c579893f9b85ee8f20be1fab437edffe32d2ddf3cdf9f5f1ec8baad49560221893f1eaa02a975c4c392cf6a9ef669828fb4a728742b8fbebba9b5e196d67
SSDEEP

6144:E1WvuSwbJ0xjo4R1yeJDd6lY10EArPjeF5G:E1UuSw4o4XDd6uusO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7363384de63aeb2d44db51c70a164ad6_JaffaCakes118

Files

7363384de63aeb2d44db51c70a164ad6_JaffaCakes118
.dll windows:4 windows x86 arch:x86

2238df21349ebc9132a9f2821ab5e5e9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\_cs06070215\es-release-build\plugins\ESWireless-Root\ESUIWireless\Release\ESUIWireless.pdb

Imports

vistadb.esx

?SQSetWirelessConnection@CStockQuery@@SAJ_N@Z
?GetSerialNumber@DevicePrefsCat@@QAE?AW4SUPPORTS_ERRORS@@AAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?Commit@DevicePrefsCat@@QAE?AW4SUPPORTS_ERRORS@@XZ
?SetPListValue@DevicePrefsCat@@QAE?AW4SUPPORTS_ERRORS@@W4DevicePrefsSubTypes@1@V?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@V_variant_t@@@Z
?GetPListValue@DevicePrefsCat@@QAE?AW4SUPPORTS_ERRORS@@HV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@AAV_variant_t@@@Z
?SQGetWirelessConnection@CStockQuery@@SAJAA_N@Z
?SQGetAllDeviceInfo@CStockQuery@@SA?AW4SUPPORTS_ERRORS@@AAVCStringArray@@00AAV?$vector@HV?$allocator@H@std@@@std@@1H@Z
?SetDeviceSerialNumber@DevicePrefsCat@@QAE?AW4SUPPORTS_ERRORS@@V?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?Instance@AtlasManager@@SAPAV1@XZ
?GetAtlasUser@AtlasManager@@QAE?AV?$shared_ptr@VAtlasUser@@@boost@@XZ

spiffyext

?GetMessageMap@CSpiffyDialog@@MBEPBUAFX_MSGMAP@@XZ
?GetThisClass@CSpiffyDialog@@SGPAUCRuntimeClass@@XZ
?GetRuntimeClass@CSpiffyDialog@@UBEPAUCRuntimeClass@@XZ
??0CSpiffyDialog@@QAE@IPAVCWnd@@@Z
?OnInitDialog@CSpiffyDialog@@MAEHXZ
?GetThisMessageMap@CSpiffyDialog@@KGPBUAFX_MSGMAP@@XZ
??1CSpiffyDialog@@UAE@XZ
?OnToolHitTest@CSpiffyDialog@@UBEHVCPoint@@PAUtagTOOLINFOA@@@Z
?GetSpiffyColor@@YAKW4SPIFFYCOLORS@@@Z

atlas

?SetCollectionName@AtlasUser@@QAEJABVSystemString@@@Z
?InitAtlasCategory@AtlasCategory@@QAEXABV?$shared_ptr@VAtlasUser@@@boost@@ABVSystemString@@H@Z
?GetCollectionName@AtlasUser@@QAEJAAVSystemString@@@Z

mfc71

ord5529
ord907
ord2451
ord3161
ord347
ord602
ord1279
ord501
ord709
ord572
ord760
ord3204
ord1511
ord2793
ord2791
ord4221
ord1014
ord2105
ord727
ord3684
ord2160
ord2368
ord1280
ord6065
ord6282
ord5986
ord2527
ord5637
ord2264
ord5642
ord502
ord1934
ord3210
ord5641
ord4123
ord4001
ord5214
ord6147
ord3350
ord5623
ord5987
ord1425
ord1903
ord6067
ord4261
ord4967
ord1402
ord5915
ord3337
ord2654
ord676
ord564
ord755
ord6236
ord314
ord3406
ord1123
ord2321
ord1486
ord782
ord1098
ord371
ord1175
ord6017
ord642
ord2367
ord2370
ord2083
ord2075
ord3180
ord5719
ord5921
ord5401
ord5414
ord5588
ord5523
ord5647
ord5727
ord6037
ord5888
ord6057
ord4161
ord6054
ord5608
ord6060
ord5611
ord3214
ord4236
ord1558
ord1637
ord6099
ord5717
ord3864
ord3867
ord300
ord2403
ord2415
ord2392
ord2396
ord2398
ord2322
ord2390
ord5233
ord5235
ord783
ord303
ord443
ord3997
ord1908
ord764
ord762
ord578
ord266
ord304
ord781
ord297
ord557
ord745
ord310
ord2657
ord5613
ord5807
ord4035
ord2164
ord1122
ord2662
ord6006
ord5715
ord5833
ord1482
ord1063
ord1669
ord6090
ord4125
ord722
ord1185
ord530
ord2372
ord3761
ord2325
ord4262
ord4486
ord3949
ord2644
ord3709
ord3719
ord3718
ord2533
ord2646
ord2933
ord2540
ord1084
ord5403
ord2468
ord784
ord5182
ord4212
ord4735
ord4890
ord2020
ord1671
ord1670
ord1551
ord5912
ord1620
ord1617
ord3946
ord1401
ord4244
ord5152
ord5073
ord6275
ord4185
ord5203
ord3403
ord4722
ord4282
ord1600
ord5960
ord923
ord928
ord932
ord930
ord934
ord2410
ord2394
ord2413
ord2408
ord2385
ord2387
ord2405
ord2178
ord2172
ord1522
ord6279
ord3802
ord6277
ord3345
ord1362
ord5175
ord1964
ord1656
ord1655
ord1599
ord5200
ord2537
ord2731
ord2835
ord4307
ord2714
ord2862
ord2400

msvcr71

malloc
strcmp
strlen
?name@type_info@@QBEPBDXZ
strcat
_purecall
??8type_info@@QBEHABV0@@Z
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
__RTDynamicCast
?raw_name@type_info@@QBEPBDXZ
_mbslen
sscanf
free
memmove
iswascii
iswxdigit
atoi
_except_handler3
__CxxFrameHandler
__dllonexit
_onexit
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_initterm
_adjust_fdiv
__CppXcptFilter
__security_error_handler
memset
memcpy
wcslen
_CxxThrowException

kernel32

GetSystemTimeAsFileTime
GetTickCount
ExitProcess
MultiByteToWideChar
WideCharToMultiByte
CompareStringA
LocalFree
lstrlenA
GetCurrentThreadId
LeaveCriticalSection
EnterCriticalSection
InterlockedIncrement
FreeLibrary
LoadLibraryA
GetModuleFileNameA
QueryPerformanceCounter
ReleaseMutex
WaitForSingleObject
CreateMutexA
InterlockedCompareExchange
WriteFile
SetFilePointer
CreateFileA
OutputDebugStringA
InterlockedExchange
Sleep
TlsGetValue
TlsSetValue
GetCurrentProcessId
TlsAlloc
GetSystemInfo
LockResource
GetVersionExA
OpenFileMappingA
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
GetLastError
GlobalAlloc
GetProcAddress
SizeofResource
LoadResource
FindResourceA
CloseHandle
HeapAlloc
GetProcessHeap
InitializeCriticalSection
GlobalFree
GetLocaleInfoA
InterlockedDecrement
DeleteCriticalSection

user32

IsWindowVisible
MoveWindow
SendMessageA
GetWindowRect
MessageBoxA
GrayStringA
DrawTextExA
TabbedTextOutA
DrawFocusRect
GetParent
SetWindowLongA
GetWindowLongA
InflateRect
DrawFrameControl
ShowScrollBar
ScreenToClient
GetCursorPos
PtInRect
RedrawWindow
BeginDeferWindowPos
DrawTextA
ReleaseDC
GetDC
GetClientRect
KillTimer
SetTimer
wvsprintfA
SetRectEmpty
EndDeferWindowPos
wsprintfA
DeferWindowPos
EnableWindow
InvalidateRect

gdi32

ExtTextOutA
Escape
RectVisible
TextOutA
PtVisible
GetCurrentObject
GetTextAlign
SetWindowOrgEx
SelectObject
GetTextExtentPoint32A
CreateFontIndirectA
GetObjectA
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
DeleteObject

advapi32

RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExA
InitializeSecurityDescriptor
RegSetValueExA
SetSecurityDescriptorDacl

comctl32

ImageList_GetImageInfo

ole32

CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
OleRun

oleaut32

GetErrorInfo
SysAllocStringByteLen
SysStringByteLen
VariantInit
VariantClear
SysStringLen
SysFreeString
SysAllocString
VariantChangeType

msvcp71

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z

locesuiwireless

_MyLocDllHandle

Exports

Exports

??0AddressObject@@QAE@XZ
??1AddressObject@@UAE@XZ
??_7AddressObject@@6B@
?Construct@AddressObject@@QAE?AW4SUPPORTS_ERRORS@@V?$shared_ptr@VBinaryInterface@@@boost@@@Z
?GetAsciiType@AddressObject@@UAE?AVSystemString@@XZ
GetFactory
InitializeExtension
ShutdownExtension

Sections

.text
Size: 137KB - Virtual size: 136KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2238df21349ebc9132a9f2821ab5e5e9

Headers

File Characteristics

PDB Paths

Imports

vistadb.esx

spiffyext

atlas

mfc71

msvcr71

kernel32

user32

gdi32

advapi32

comctl32

ole32

oleaut32

msvcp71

locesuiwireless

Exports

Exports

Sections

.text Size: 137KB - Virtual size: 136KB

.rdata Size: 40KB - Virtual size: 39KB

.data Size: 7KB - Virtual size: 7KB

.rsrc Size: 1024B - Virtual size: 1024B

.reloc Size: 28KB - Virtual size: 27KB

.text
Size: 137KB - Virtual size: 136KB

.rdata
Size: 40KB - Virtual size: 39KB

.data
Size: 7KB - Virtual size: 7KB

.rsrc
Size: 1024B - Virtual size: 1024B

.reloc
Size: 28KB - Virtual size: 27KB