b0943b15082a5bdf79916cbe238852ba_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

b0943b15082a5bdf79916cbe238852ba_JaffaCakes118
Size

239KB
MD5

b0943b15082a5bdf79916cbe238852ba
SHA1

b8828968ce5b8d21473d35e28da565843a6833fb
SHA256

7254fe4cf7780dfd0be883979ae1e6348a1bf7ca61db18aadf2ebb50b6bb5349
SHA512

bd26cdb80ceff22a45f2a75a9703b9ce0f01858e7642fe6de740ea7ab506c3542c577bc6864c3da7b8ad62507126b2e59c51765856692d8cf83c62f97b3da120
SSDEEP

6144:R5cX+SKT5Dw6AqNWAaiCJ0+3O1fFLo1Z3rHiSfnc/XS9A:R5cX+SKTFMAaXXZ3rHiSfncvSA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b0943b15082a5bdf79916cbe238852ba_JaffaCakes118

Files

b0943b15082a5bdf79916cbe238852ba_JaffaCakes118
.dll windows:5 windows x86 arch:x86

930b1ea5ee052e0a22afaf4d789c44ed

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

o:\OOO320\src\embedserv\wntmsci12.pro\bin\emsermi.pdb

Imports

sal3

osl_getThreadKeyData
rtl_uString_new
rtl_uString_acquire
rtl_uString_newFromStr
rtl_ustr_compare_WithLength
osl_setThreadKeyData
rtl_ustr_ascii_compare_WithLength
osl_createMutex
osl_destroyMutex
rtl_getGlobalProcessId
osl_decrementInterlockedCount
osl_destroyThreadKey
osl_createThreadKey
osl_getGlobalMutex
osl_releaseMutex
osl_acquireMutex
osl_incrementInterlockedCount
rtl_freeMemory
rtl_allocateMemory
rtl_uString_newFromAscii
rtl_ustr_reverseCompare_WithLength
rtl_uString_assign
rtl_string2UString
rtl_uString_release
rtl_uString_newConcat

cppu3

uno_type_assignData
uno_type_any_assign
cppu_unsatisfied_iquery_msg
uno_type_sequence_assign
uno_type_sequence_realloc
typelib_typedescriptionreference_release
typelib_typedescriptionreference_acquire
typelib_typedescriptionreference_assign
uno_type_destructData
uno_type_equalData
uno_any_destruct
uno_type_any_construct
uno_any_construct
typelib_static_type_init
typelib_typedescriptionreference_equals
uno_type_sequence_reference2One
typelib_static_type_getByTypeClass
uno_type_sequence_construct
typelib_static_sequence_type_init

cppuhelper3msc

?acquire@OWeakObject@cppu@@UAAXXZ
?getElements@OInterfaceContainerHelper@cppu@@QBA?AV?$Sequence@V?$Reference@VXInterface@uno@star@sun@com@@@uno@star@sun@com@@@uno@star@sun@com@@XZ
?getLength@OInterfaceContainerHelper@cppu@@QBAJXZ
?disposeAndClear@OInterfaceContainerHelper@cppu@@QAAXABUEventObject@lang@star@sun@com@@@Z
?removeInterface@OInterfaceContainerHelper@cppu@@QAAJABV?$Reference@VXInterface@uno@star@sun@com@@@uno@star@sun@com@@@Z
??0OInterfaceContainerHelper@cppu@@QAE@AAVMutex@osl@@@Z
?addInterface@OInterfaceContainerHelper@cppu@@QAAJABV?$Reference@VXInterface@uno@star@sun@com@@@uno@star@sun@com@@@Z
??1OInterfaceContainerHelper@cppu@@QAE@XZ
?ImplHelper_getImplementationId@cppu@@YA?AV?$Sequence@C@uno@star@sun@com@@PAUclass_data@1@@Z
?WeakImplHelper_getTypes@cppu@@YA?AV?$Sequence@VType@uno@star@sun@com@@@uno@star@sun@com@@PAUclass_data@1@@Z
?WeakImplHelper_query@cppu@@YA?AVAny@uno@star@sun@com@@ABVType@3456@PAUclass_data@1@PAXPAVOWeakObject@1@@Z
?get@WeakReferenceHelper@uno@star@sun@com@@QBA?AV?$Reference@VXInterface@uno@star@sun@com@@@2345@XZ
??0WeakReferenceHelper@uno@star@sun@com@@QAE@ABV?$Reference@VXInterface@uno@star@sun@com@@@1234@@Z
??4WeakReferenceHelper@uno@star@sun@com@@QAAAAV01234@ABV01234@@Z
??1WeakReferenceHelper@uno@star@sun@com@@QAE@XZ
??1OImplementationId@cppu@@QAE@XZ
??0OTypeCollection@cppu@@QAE@ABVType@uno@star@sun@com@@0ABV?$Sequence@VType@uno@star@sun@com@@@3456@@Z
?queryInterface@OWeakObject@cppu@@UAA?AVAny@uno@star@sun@com@@ABVType@4567@@Z
?getImplementationId@OImplementationId@cppu@@QBA?AV?$Sequence@C@uno@star@sun@com@@XZ
??0OWeakObject@cppu@@QAE@XZ
?queryAdapter@OWeakObject@cppu@@UAA?AV?$Reference@VXAdapter@uno@star@sun@com@@@uno@star@sun@com@@XZ
?createOneInstanceFactory@cppu@@YA?AV?$Reference@VXSingleServiceFactory@lang@star@sun@com@@@uno@star@sun@com@@ABV?$Reference@VXMultiServiceFactory@lang@star@sun@com@@@3456@ABVOUString@rtl@@P6A?AV?$Reference@VXInterface@uno@star@sun@com@@@3456@0@ZABV?$Sequence@VOUString@rtl@@@3456@PAU_rtl_ModuleCount@@@Z
??1OWeakObject@cppu@@MAE@XZ
?release@OWeakObject@cppu@@UAAXXZ

ole32

CoTaskMemRealloc
CoTaskMemAlloc
CreateDataAdviseHolder
StgCreateDocfile
WriteFmtUserTypeStg
CoGetMalloc
CoTaskMemFree
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
CoRegisterClassObject
CoRevokeClassObject
CoCreateInstance

gdi32

CreateRectRgnIndirect
SetRectRgn
SelectObject
SelectClipRgn
GetClipBox
PatBlt
CreatePen
CreatePatternBrush
SetMapMode
LPtoDP
CreateRectRgn
CombineRgn
DeleteObject
RestoreDC
CreateSolidBrush
SetBkMode
UnrealizeObject
Rectangle
SetROP2
SetWindowOrgEx
CreateBitmap
SetViewportOrgEx

oleaut32

VariantClear
VarUI4FromStr
SysFreeString

advapi32

RegQueryInfoKeyA
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
RegEnumKeyExA

msvcr90

??_V@YAXPAX@Z
_CxxThrowException
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBDH@Z
??1exception@std@@UAE@XZ
__CxxFrameHandler3
??3@YAXPAX@Z
??2@YAPAXI@Z
memset
strstr
malloc
free
memcpy_s
strncpy_s
_resetstkoflw
_recalloc
??_U@YAPAXI@Z
memmove_s
?terminate@@YAXXZ
_unlock
_encode_pointer
_lock
_onexit
_decode_pointer
_except_handler4_common
_malloc_crt
_encoded_null
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
__clean_type_info_names_internal
??0exception@std@@QAE@ABV01@@Z
__dllonexit
wcsncpy

uwinapi

GetMenuItemInfoW
MultiByteToWideChar
WideCharToMultiByte
lstrlenW
SetWindowLongA
GetWindowLongA
SetMenuItemInfoW

kernel32

DeleteCriticalSection
InitializeCriticalSection
RaiseException
LoadLibraryA
GetProcAddress
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
LeaveCriticalSection
EnterCriticalSection
GetProfileIntA
DisableThreadLibraryCalls
GetModuleFileNameA
GetModuleHandleA
LoadLibraryExA
FindResourceA
LoadResource
SizeofResource
FreeLibrary
IsDBCSLeadByte
lstrcmpiA
lstrlenA
InterlockedDecrement
InterlockedIncrement
GetLastError

user32

EqualRect
GetMessageA
ReleaseCapture
CopyRect
SetRectEmpty
ClientToScreen
InflateRect
IntersectRect
SetWindowPos
LoadCursorA
RegisterClassA
DefWindowProcA
SendMessageA
GetCursorPos
ScreenToClient
GetParent
BeginPaint
EndPaint
CreateWindowExA
IsWindow
DestroyWindow
CharNextA
RegisterClipboardFormatA
GetDC
ReleaseDC
SetFocus
CreateMenu
GetMenuItemCount
GetWindow
ShowWindow
SetParent
GetClientRect
SetWindowRgn
SetRect
GetSubMenu
GetMenuStringA
InsertMenuA
DispatchMessageA
GetDCEx
UpdateWindow
SetCapture
GetCapture
PtInRect
SetCursor
FillRect

stlport_vc7145

?_M_fill_insert@?$vector@PAXV?$allocator@PAX@_STL@@@_STL@@QAEXPAPAXIABQAX@Z
?get_allocator@?$vector@PAXV?$allocator@PAX@_STL@@@_STL@@QBE?AV?$allocator@PAX@2@XZ
??0?$vector@PAXV?$allocator@PAX@_STL@@@_STL@@QAE@IABQAXABV?$allocator@PAX@1@@Z
?swap@?$vector@PAXV?$allocator@PAX@_STL@@@_STL@@QAEXAAV12@@Z
?clear@?$vector@PAXV?$allocator@PAX@_STL@@@_STL@@QAEXXZ
?allocate@?$__node_alloc@$00$0A@@_STL@@SAPAXI@Z
??0?$vector@PAXV?$allocator@PAX@_STL@@@_STL@@QAE@ABV?$allocator@PAX@1@@Z
??1?$allocator@PAX@_STL@@QAE@XZ
?deallocate@?$__node_alloc@$00$0A@@_STL@@SAXPAXI@Z
??1?$vector@PAXV?$allocator@PAX@_STL@@@_STL@@QAE@XZ
?reserve@?$vector@PAXV?$allocator@PAX@_STL@@@_STL@@QAEXI@Z

Exports

Exports

GetVersionInfo
component_getFactory
component_getImplementationEnvironment
component_writeInfo

Sections

.text
Size: 89KB - Virtual size: 88KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 95KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

930b1ea5ee052e0a22afaf4d789c44ed

Headers

File Characteristics

PDB Paths

Imports

sal3

cppu3

cppuhelper3msc

ole32

gdi32

oleaut32

advapi32

msvcr90

uwinapi

kernel32

user32

stlport_vc7145

Exports

Exports

Sections

.text Size: 89KB - Virtual size: 88KB

.rdata Size: 43KB - Virtual size: 43KB

.data Size: 2KB - Virtual size: 3KB

.rsrc Size: 95KB - Virtual size: 95KB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 89KB - Virtual size: 88KB

.rdata
Size: 43KB - Virtual size: 43KB

.data
Size: 2KB - Virtual size: 3KB

.rsrc
Size: 95KB - Virtual size: 95KB

.reloc
Size: 8KB - Virtual size: 7KB