e083f4280ff6fb36b95c391e1547b439_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

e083f4280ff6fb36b95c391e1547b439_JaffaCakes118
Size

348KB
MD5

e083f4280ff6fb36b95c391e1547b439
SHA1

bb94cda39ec2785a444800917a0cf0d25605d3f3
SHA256

1d737659c1b15b102673907935f98a8ab5cd941dfada319cd8e2f21d637c1369
SHA512

7f0df8020fefa9b764bd89a3ea819f9ff39c1f3daefbd4b2aa5764f8ebaec954ef1bd37448a3601b972fd1c2a241ca7ca81fb241e9daf619675b02a8f7ab9815
SSDEEP

6144:Wb56pgkTFXn6oGd8J7R7WmGe6clHVTmc19sWsa:Wv0FXByWxWVe6cl1tDsE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e083f4280ff6fb36b95c391e1547b439_JaffaCakes118

Files

e083f4280ff6fb36b95c391e1547b439_JaffaCakes118
.dll windows:4 windows x86 arch:x86

6b4c886a9edc38ffab2cd6fb05dccd79

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

coordsys

?InitCSYSAsDefaultLL@@YAPAVCSYS@@XZ
?InitCSYSFromMetadata@@YAPAVCSYS@@PBVMetadata@@@Z
?InitCSYS@@YAPAVCSYS@@PBV1@@Z

geoobject

?Create@GeoObject@@SAPAV1@W4OBJECT_TYPE@@@Z
?GetGeoObjectRW@@YAPAVGeoObjectRW@@PAVGeoObject@@@Z

mirdb

?Destroy@RDBEngine@@SA_NPAV1@@Z
?Create@RDBEngine@@SAPAV1@XZ

styles

?Create@cToolSettings@@SAPAV1@PBVMetadata@@@Z
?Create@cToolSettings@@SAPAV1@W4SYMBOL_TYPE@@@Z
?Create@cPen@@SAPAV1@FABW4PAT_STYLE@@ABVcColor@@@Z
?Create@cFont@@SAPAV1@XZ
??1cColor@@QAE@XZ
?Create@cToolSettings@@SAPAV1@PBV1@@Z

utility

?miStrICmp@@YAHPBD0@Z
?strequ@@YA_NPBD0@Z
?strcpyn@@YAPADPADPBDI@Z
?SetRect@@YAXAAUDRECT@@NNNN@Z
?miStrtok@@YA_NABVstring@mtl@@K0PAK11PBD@Z
?miStrtok@@YAPADPADPBD_NPAPAD@Z
?striequ@@YA_NPBD0@Z
?GetWidthHeightOfRect@@YAXABUDRECT@@AAN1@Z
?frealloc_@@YA_NIPAPAX@Z
?falloc_@@YA_NIPAPAX_N1@Z
?Dequeue@@YA_NPAUQUEUE@@PAPAVQ_ELEM@@H@Z
?DeleteQueue@@YAXPAUQUEUE@@@Z
??_7Q_ELEM@@6B@
?InitQueue@@YAXPAUQUEUE@@@Z
??1Q_ELEM@@UAE@XZ
?ffree@@YAXPAPAX@Z
?ClearErrors@@YAXXZ
??1cResourceDLL@@UAE@XZ
??0cResourceDLL@@QAE@XZ
?Enqueue@@YAXPAUQUEUE@@PAVQ_ELEM@@H@Z
?SetError@@YAXW4eErrorLevel@@PBDABU_GUID@@H11@Z

msvcrt

__CxxFrameHandler
strncmp
_strlwr
ceil
_adjust_fdiv
malloc
_initterm
free
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_except_handler3
_onexit
__dllonexit
fabs
_CxxThrowException
strncpy
_strupr
memchr
sscanf
strchr
_splitpath
_makepath
_purecall
sprintf
log10
pow
_ftol
memmove

msvcp60

?_Xran@std@@YAXXZ
?_Xlen@std@@YAXXZ

kernel32

GetModuleHandleA
GetModuleFileNameA
LoadLibraryA

Exports

Exports

?Create@MIBLOB@@SAPAV1@PBVCSYS@@PBVcToolSettings@@@Z
?Create@MIRdbMapCatalog@@SAPAV1@PAVRDBConnection@@HPAVMIMetadataProcessor@@@Z
?Create@RDBSpatialEngine@@SAPAV1@XZ
?Create@RDBSpatialSchemaDB2@@SAPAVRDBSpatialSchema@@PBVRDBSpatialConnectionImpl@@PAVMISpatialInfo@@@Z
?Create@RDBSpatialSchemaIUS@@SAPAVRDBSpatialSchema@@PBVRDBSpatialConnectionImpl@@PAVMISpatialInfo@@@Z
?Create@RDBSpatialSchemaIUSMMSW@@SAPAVRDBSpatialSchema@@PBVRDBSpatialConnectionImpl@@PAVMISpatialInfo@@@Z
?Create@RDBSpatialSchemaIUSMMXY@@SAPAVRDBSpatialSchema@@PBVRDBSpatialConnectionImpl@@PAVMISpatialInfo@@@Z
?Create@RDBSpatialSchemaMicode@@SAPAVRDBSpatialSchema@@PBVRDBSpatialConnectionImpl@@PAVMISpatialInfo@@@Z
?Create@RDBSpatialSchemaOra@@SAPAVRDBSpatialSchema@@PBVRDBSpatialConnectionImpl@@PAVMISpatialInfo@@@Z
?Create@RDBSpatialSchemaSW@@SAPAVRDBSpatialSchema@@PBVRDBSpatialConnectionImpl@@PAVMISpatialInfo@@@Z
?Create@RDBSpatialSchemaXY@@SAPAVRDBSpatialSchema@@PBVRDBSpatialConnectionImpl@@PAVMISpatialInfo@@@Z
?Destroy@RDBSpatialEngine@@SA_NPAV1@@Z
?IsSupportedGeoObjectType@MIBLOB@@SA_NW4OBJECT_TYPE@@@Z

Sections

.text
Size: 100KB - Virtual size: 96KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.text
Size: 212KB - Virtual size: 212KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

6b4c886a9edc38ffab2cd6fb05dccd79

Headers

File Characteristics

Imports

coordsys

geoobject

mirdb

styles

utility

msvcrt

msvcp60

kernel32

Exports

Exports

Sections

.text Size: 100KB - Virtual size: 96KB

.rdata Size: 12KB - Virtual size: 11KB

.data Size: 8KB - Virtual size: 36KB

.rsrc Size: 4KB - Virtual size: 1016B

.reloc Size: 8KB - Virtual size: 7KB

.text Size: 212KB - Virtual size: 212KB

.text
Size: 100KB - Virtual size: 96KB

.rdata
Size: 12KB - Virtual size: 11KB

.data
Size: 8KB - Virtual size: 36KB

.rsrc
Size: 4KB - Virtual size: 1016B

.reloc
Size: 8KB - Virtual size: 7KB

.text
Size: 212KB - Virtual size: 212KB