sqlceme30.pdb
Static task
static1
Behavioral task
behavioral1
Sample
fae6a005ccb220decb6fdc30e7b4e792_JaffaCakes118.dll
Resource
win7-20240729-en
General
-
Target
fae6a005ccb220decb6fdc30e7b4e792_JaffaCakes118
-
Size
142KB
-
MD5
fae6a005ccb220decb6fdc30e7b4e792
-
SHA1
1b7d08c6c7867088d15e01089bf1687f156731d0
-
SHA256
25989e137307c0d49435bb86f558f216d36131224892eb12e2662646fb0b0166
-
SHA512
4505ba4f38230b7a814cb1ed70734394601a229d2893687cde67dde16e4cfb7b52a73ea1692e1f0371e16706d7aa521e04ba6528aa356985aa599c0ee8da887e
-
SSDEEP
3072:QOxAYsgpCN1tIhv8KawbZY0WQdKHEaBKMGyY6nY7nmj:rxAlga1s2wZZdKN5Y6nY7nm
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fae6a005ccb220decb6fdc30e7b4e792_JaffaCakes118
Files
-
fae6a005ccb220decb6fdc30e7b4e792_JaffaCakes118.dll windows:5 windows x86 arch:x86
ed4686c2880f35dd3d435811e5f5c478
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
LoadLibraryA
GetLastError
InterlockedDecrement
FreeLibrary
InterlockedIncrement
GetProcAddress
WaitForSingleObject
WideCharToMultiByte
ReleaseMutex
GetFileSize
SetFilePointer
SetEndOfFile
WriteFile
CloseHandle
Sleep
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetModuleFileNameW
LoadLibraryW
GetModuleHandleW
GetLocaleInfoW
OutputDebugStringW
ole32
CoCreateGuid
CoCreateInstance
oleaut32
SysFreeString
SysAllocString
VariantInit
SysAllocStringLen
VariantClear
msvcrt
_wcsnicmp
memcpy
memset
??2@YAPAXI@Z
??3@YAXPAX@Z
memcmp
free
wcsncpy
wcslen
_snwprintf
wcsrchr
malloc
_initterm
_adjust_fdiv
__dllonexit
_onexit
wprintf
wcscpy
swprintf
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
advapi32
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
Exports
Exports
DllAddRef
DllCanUnloadNow
DllMain
DllRelease
ME_AbortTransaction
ME_ClearErrorInfo
ME_CloseStore
ME_CommitTransaction
ME_CompileQueryPlan
ME_CreateCommand
ME_CreateDatabase
ME_CreateErrorInstance
ME_DeleteArray
ME_DeleteRecord
ME_ExecuteQueryPlan
ME_GetBookmark
ME_GetColumnInfo
ME_GetColumnOrdinal
ME_GetColumnsUpdated
ME_GetContextErrorInfo
ME_GetIndexColumnOrdinals
ME_GetKeyInfo
ME_GetMinorError
ME_GetParameterInfo
ME_GetSqlCeVersionInfo
ME_GetValues
ME_GotoBookmark
ME_InsertRecord
ME_Move
ME_OpenCursor
ME_OpenStore
ME_OpenTransaction
ME_Prepare
ME_Read
ME_ReadAt
ME_Rebuild
ME_SafeDelete
ME_SafeRelease
ME_Seek
ME_SetContextErrorInfo
ME_SetRange
ME_SetValue
ME_SetValues
ME_UpdateRecord
uwrda_Pull
uwrda_Push
uwrda_RemoteDataAccess
uwrda_SubmitSql
uwrda_SysFreeString
uwrda_get_CompressionLevel
uwrda_get_ConnectTimeout
uwrda_get_ConnectionManager
uwrda_get_ConnectionRetryTimeout
uwrda_get_ErrorPointer
uwrda_get_InternetLogin
uwrda_get_InternetPassword
uwrda_get_InternetProxyLogin
uwrda_get_InternetProxyPassword
uwrda_get_InternetProxyServer
uwrda_get_InternetUrl
uwrda_get_LocalConnectionString
uwrda_get_ReceiveTimeout
uwrda_get_SendTimeout
uwrda_put_CompressionLevel
uwrda_put_ConnectTimeout
uwrda_put_ConnectionManager
uwrda_put_ConnectionRetryTimeout
uwrda_put_InternetLogin
uwrda_put_InternetPassword
uwrda_put_InternetProxyLogin
uwrda_put_InternetProxyPassword
uwrda_put_InternetProxyServer
uwrda_put_InternetUrl
uwrda_put_LocalConnectionString
uwrda_put_ReceiveTimeout
uwrda_put_SendTimeout
uwrepl_AddSubscription
uwrepl_AsyncReplication
uwrepl_Cancel
uwrepl_DropSubscription
uwrepl_GetSyncResult
uwrepl_Initialize
uwrepl_LoadProperties
uwrepl_ReinitializeSubscription
uwrepl_Replication
uwrepl_Run
uwrepl_SaveProperties
uwrepl_Terminate
uwrepl_WaitForNextStatusReport
uwrepl_get_CompressionLevel
uwrepl_get_ConnectTimeout
uwrepl_get_ConnectionManager
uwrepl_get_ConnectionRetryTimeout
uwrepl_get_Distributor
uwrepl_get_DistributorAddress
uwrepl_get_DistributorLogin
uwrepl_get_DistributorNetwork
uwrepl_get_DistributorPassword
uwrepl_get_DistributorSecurityMode
uwrepl_get_ErrorPointer
uwrepl_get_ExchangeType
uwrepl_get_HostName
uwrepl_get_InternetLogin
uwrepl_get_InternetPassword
uwrepl_get_InternetProxyLogin
uwrepl_get_InternetProxyPassword
uwrepl_get_InternetProxyServer
uwrepl_get_InternetUrl
uwrepl_get_LoginTimeout
uwrepl_get_ProfileName
uwrepl_get_Publication
uwrepl_get_Publisher
uwrepl_get_PublisherAddress
uwrepl_get_PublisherChanges
uwrepl_get_PublisherConflicts
uwrepl_get_PublisherDatabase
uwrepl_get_PublisherLogin
uwrepl_get_PublisherNetwork
uwrepl_get_PublisherPassword
uwrepl_get_PublisherSecurityMode
uwrepl_get_QueryTimeout
uwrepl_get_ReceiveTimeout
uwrepl_get_SendTimeout
uwrepl_get_SnapshotTransferType
uwrepl_get_Subscriber
uwrepl_get_SubscriberChanges
uwrepl_get_SubscriberConflicts
uwrepl_get_SubscriberConnectionString
uwrepl_get_Validate
uwrepl_put_CompressionLevel
uwrepl_put_ConnectTimeout
uwrepl_put_ConnectionManager
uwrepl_put_ConnectionRetryTimeout
uwrepl_put_Distributor
uwrepl_put_DistributorAddress
uwrepl_put_DistributorLogin
uwrepl_put_DistributorNetwork
uwrepl_put_DistributorPassword
uwrepl_put_DistributorSecurityMode
uwrepl_put_ExchangeType
uwrepl_put_HostName
uwrepl_put_InternetLogin
uwrepl_put_InternetPassword
uwrepl_put_InternetProxyLogin
uwrepl_put_InternetProxyPassword
uwrepl_put_InternetProxyServer
uwrepl_put_InternetUrl
uwrepl_put_LoginTimeout
uwrepl_put_ProfileName
uwrepl_put_Publication
uwrepl_put_Publisher
uwrepl_put_PublisherAddress
uwrepl_put_PublisherDatabase
uwrepl_put_PublisherLogin
uwrepl_put_PublisherNetwork
uwrepl_put_PublisherPassword
uwrepl_put_PublisherSecurityMode
uwrepl_put_QueryTimeout
uwrepl_put_ReceiveTimeout
uwrepl_put_SendTimeout
uwrepl_put_SnapshotTransferType
uwrepl_put_Subscriber
uwrepl_put_SubscriberConnectionString
uwrepl_put_Validate
uwutil_ReleaseCOMPtr
uwutil_SysFreeString
uwutil_ZeroMemory
uwutil_get_Error
uwutil_get_ErrorCount
Sections
.text Size: 30KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 109KB - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ