2fa8141311693495450a15d8f3b2fc19_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

2fa8141311693495450a15d8f3b2fc19_JaffaCakes118
Size

167KB
MD5

2fa8141311693495450a15d8f3b2fc19
SHA1

bae1eaa43518dea6beff4d04d2109939b464728c
SHA256

72ba9d5bd0c15093de093faf22fe7c227622f0ce57d3cb99641ba5440df50fcd
SHA512

44d72aceb9dd355f646c216c18b6b6d574fd594e328b823993ccdd85cef3d6361577259ee616a54e7caf40d7ed20c48d92d0bed6ef3b237fadad3dc28bf98549
SSDEEP

3072:TpfQcx5pFtlkBA92PpeIsfSYq+Eg07pGTxQTcWBiqI8O6VPPc+ghG:TlQcPw/sfFEg07pGmTcWBiqI8O6VPPSh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2fa8141311693495450a15d8f3b2fc19_JaffaCakes118

Files

2fa8141311693495450a15d8f3b2fc19_JaffaCakes118
.dll windows:4 windows x86 arch:x86

f84daa86c9759475c469d93eae1e3069

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\_ct10301026\es-copen-build\plugins\bin\Pcd.pdb

Imports

atlas

?URIappendAssetQueryElement@AtlasUser@@QAE?AW4SUPPORTS_ERRORS@@AAVSystemString@@ABV3@1@Z
?URIappendPathSegment@AtlasUser@@QAE?AW4SUPPORTS_ERRORS@@AAVSystemString@@ABV3@@Z
?CreateCategoryURI@AtlasUser@@QAEAAVSystemString@@ABV2@@Z
?URIaddReference@AtlasUser@@QAE?AW4SUPPORTS_ERRORS@@AAVSystemString@@ABV3@@Z
?LoadByURI@AtlasUser@@QAE?AW4SUPPORTS_ERRORS@@ABVSystemString@@AAV?$shared_ptr@VpjObject@@@boost@@@Z
?URIappendCategoryQueryElement@AtlasUser@@QAE?AW4SUPPORTS_ERRORS@@AAVSystemString@@ABV3@1@Z

shlwapi

PathStripPathA
PathAppendW
PathCanonicalizeA
PathIsRootA
PathFindFileNameA
PathAppendA
PathStripToRootA

vistadb.esx

?GetRequest@CGetTopLabelsQuery@@UAE?AV?$shared_ptr@VAtlasRequest@@@boost@@XZ
?GetRequest@CGetChildLabelsQuery@@UAE?AV?$shared_ptr@VAtlasRequest@@@boost@@XZ
?GetRequest@CGetLabelsFromImagesQuery@@UAE?AV?$shared_ptr@VAtlasRequest@@@boost@@XZ
?GetRequest@CLabelsByImageQuery@@UAE?AV?$shared_ptr@VAtlasRequest@@@boost@@XZ
??0CStockQuery@@QAE@XZ
?GetRequest@CAllAddressesQuery@@UAE?AV?$shared_ptr@VAtlasRequest@@@boost@@XZ
??1CStockQuery@@QAE@XZ
?GetRequest@CAllTrackingQuery@@UAE?AV?$shared_ptr@VAtlasRequest@@@boost@@XZ
?GetRequest@CProtectedQuery@@UAE?AV?$shared_ptr@VAtlasRequest@@@boost@@XZ
?GetAtlasUser@AtlasManager@@QAE?AV?$shared_ptr@VAtlasUser@@@boost@@XZ
?Instance@AtlasManager@@SAPAV1@XZ
?ResetLastAcqBin@AtlasManager@@QAEJXZ
?GetRequest@CGetLabelQuery@@UAE?AV?$shared_ptr@VAtlasRequest@@@boost@@XZ

kpcdinterface

?ConvertUniquePCDIdToOrderDateTime@CKPCDStore@@SA_NAAVCKString@@00W4PCDDateTimeFormat@1@@Z
?Open@CKPCDStore@@UAE?AW4PCDStatus@@VCKDirSpec@@@Z
?GetPCDFileSet@CKPCDStore@@UAE?AW4PCDStatus@@PAPAVCKPtrArray@@J@Z
?GetPCDUniqueID@CKPCDStore@@SA?AVCKString@@VCKDirSpec@@@Z
?Close@CKPCDStore@@UAE?AW4PCDStatus@@XZ
?GetCDMediaType@CKPCDStore@@SA?AW4CDMediaType@1@VCKDirSpec@@@Z
??1CKPCDStore@@UAE@XZ
??0CKPCDStore@@QAE@XZ
?GetIntroSlideShowRunPref@CKPCDStore@@SA_NXZ
?SetIntroSlideShowRunPref@CKPCDStore@@SAX_N@Z

kcor40

??0CKDirSpec@@QAE@AAV0@@Z
??0CKDirSpecList@@QAE@XZ
?FileExists@CKFileSpec@@QAE_NXZ
?SetFullPath@CKFileSpec@@QAEXVCKString@@@Z
??0CKString@@QAE@XZ
??0CKFileSpec@@QAE@XZ
??1CKFileSpec@@UAE@XZ
?GetFullPath@CKFileSpec@@QAE?AVCKString@@XZ
?GetFilename@CKFileSpec@@QAE?AVCKString@@XZ
?GetFullPathSansDevice@CKFileSpec@@QAE?AVCKString@@XZ
??0CKString@@QAE@PBD@Z
??1CKString@@UAE@XZ
??1CKDirSpecList@@UAE@XZ
?GetDir@CKDirSpec@@QAE?AVCKString@@XZ
?GetAtDirSpec@CKDirSpecList@@UAEPAVCKDirSpec@@J@Z
?GetPCDROMList@CKDirSpec@@SAJAAVCKDirSpecList@@@Z
?SetDir@CKDirSpec@@QAEXVCKString@@@Z
??0CKDirSpec@@QAE@XZ
??1CKDirSpec@@UAE@XZ
??0CKString@@QAE@ABV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
??4CKString@@QAEAAV0@ABV0@@Z

vprintonlinehelper40

?InitPrintOnlineUtils@VPrintOnlineUtils@@QAEXW4VOLServiceType@@@Z
?SetIRetailer@VPrintOnlineUtils@@QAE_NABV_bstr_t@@@Z
??1VPrintOnlineUtils@@QAE@XZ
?SetSLFalse@VPrintOnlineUtils@@QAE_NXZ
?GetSetupData@VPrintOnlineUtils@@QAE_NAAVPrintOnlineSetupData@@@Z
??0VPrintOnlineUtils@@QAE@XZ
??0PrintOnlineSetupData@@QAE@XZ
??1PrintOnlineSetupData@@QAE@XZ

mfc80

ord764
ord304
ord2324
ord266
ord2322
ord3997
ord762
ord781
ord6168
ord4081
ord5529
ord6703
ord299
ord1489
ord911
ord6118
ord907
ord1084
ord297
ord1482
ord310
ord2468
ord578
ord5403
ord2131
ord784
ord2325
ord265
ord1098
ord371
ord1175
ord1185
ord1486
ord314
ord6754
ord2469
ord298

msvcr80

??0exception@std@@QAE@ABV01@@Z
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_except_handler4_common
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
?terminate@@YAXXZ
__clean_type_info_names_internal
?_name_internal_method@type_info@@QBEPBDPAU__type_info_node@@@Z
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
__CxxFrameHandler3
_makepath
_splitpath
strtok
fclose
strlen
fgets
fopen
_mbsinc
_mbsrchr
_mbsupr
__RTDynamicCast
strcat
strcpy
_invalid_parameter_noinfo
strncpy
??0exception@std@@QAE@XZ
?raw_name@type_info@@QBEPBDXZ
memset
??1exception@std@@UAE@XZ
_CxxThrowException
_mbscmp
??8type_info@@QBE_NABV0@@Z
_vsnprintf
??0exception@std@@QAE@ABQBD@Z
_mbslen
_mbstok
memmove_s
memmove
sscanf
_mbsnbcat
?what@exception@std@@UBEPBDXZ
_mbsnbcpy
malloc
_purecall
strcmp
free

kernel32

GetACP
GetThreadLocale
GetLocaleInfoA
GetSystemTimeAsFileTime
GetTickCount
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetDiskFreeSpaceExA
GetDriveTypeA
OpenFile
Process32Next
Process32First
CreateToolhelp32Snapshot
WideCharToMultiByte
MultiByteToWideChar
DisableThreadLibraryCalls
TlsAlloc
GetSystemInfo
UnmapViewOfFile
TlsGetValue
TlsSetValue
CreateFileA
GetProcessHeap
HeapAlloc
GetVersionExA
LocalFree
Sleep
MapViewOfFile
CreateFileMappingA
OpenFileMappingA
FreeLibrary
QueryPerformanceCounter
SetEvent
GetProcAddress
LoadLibraryA
GetModuleFileNameA
FormatMessageA
GetCurrentThreadId
InterlockedDecrement
GetFileAttributesA
lstrlenA
InterlockedIncrement
OutputDebugStringA
GlobalAlloc
InterlockedExchange
GetCurrentProcess
ReleaseMutex
WaitForSingleObject
GetLastError
GlobalFree
FindClose
FindFirstFileA
CreateMutexA
GetCurrentProcessId
VirtualQuery
CloseHandle
DeleteFileA
RemoveDirectoryA
WriteFile
VirtualAlloc
SetFilePointer
InterlockedCompareExchange
GetTempPathA
VirtualFree
CreateDirectoryA
GetSystemTime

user32

wsprintfA
SendMessageA
DefWindowProcA
GetDesktopWindow
GetClassInfoExA
TranslateMessage
DispatchMessageA
RegisterClassExA
CreateWindowExA
RegisterWindowMessageA
wvsprintfA
GetMessageA

advapi32

SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegSetValueExA
RegCreateKeyExA
RegOpenKeyExA
RegCloseKey
RegQueryValueExA

shell32

SHGetMalloc
SHFileOperationA
SHGetPathFromIDListA
ShellExecuteA
SHGetDesktopFolder
SHGetSpecialFolderLocation
SHGetFileInfoA

ole32

CoTaskMemFree
CoTaskMemAlloc

oleaut32

VariantClear
SysAllocString
SysFreeString
SysStringLen
VariantInit
VariantChangeType

msvcp80

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z

locpcd

_MyLocDllHandle

Exports

Exports

??0AddressObject@@QAE@XZ
??0CAllAddressesQuery@@QAE@ABV0@@Z
??0CAllAddressesQuery@@QAE@XZ
??0CAllTrackingQuery@@QAE@ABV0@@Z
??0CAllTrackingQuery@@QAE@XZ
??0CGetChildLabelsQuery@@QAE@ABV0@@Z
??0CGetLabelQuery@@QAE@ABV0@@Z
??0CGetLabelQuery@@QAE@XZ
??0CGetLabelsFromImagesQuery@@QAE@ABV0@@Z
??0CGetLabelsFromImagesQuery@@QAE@XZ
??0CGetTopLabelsQuery@@QAE@ABV0@@Z
??0CGetTopLabelsQuery@@QAE@XZ
??0CLabelsByImageQuery@@QAE@ABV0@@Z
??0CProtectedQuery@@QAE@ABV0@@Z
??0CProtectedQuery@@QAE@XZ
??0CStockQuery@@QAE@ABV0@@Z
??1AddressObject@@UAE@XZ
??1AtlasManager@@QAE@XZ
??1CAllAddressesQuery@@QAE@XZ
??1CAllTrackingQuery@@QAE@XZ
??1CGetChildLabelsQuery@@QAE@XZ
??1CGetLabelQuery@@QAE@XZ
??1CGetLabelsFromImagesQuery@@QAE@XZ
??1CGetTopLabelsQuery@@QAE@XZ
??1CLabelsByImageQuery@@QAE@XZ
??1CProtectedQuery@@QAE@XZ
??4CAllAddressesQuery@@QAEAAV0@ABV0@@Z
??4CAllTrackingQuery@@QAEAAV0@ABV0@@Z
??4CGetChildLabelsQuery@@QAEAAV0@ABV0@@Z
??4CGetLabelQuery@@QAEAAV0@ABV0@@Z
??4CGetLabelsFromImagesQuery@@QAEAAV0@ABV0@@Z
??4CGetTopLabelsQuery@@QAEAAV0@ABV0@@Z
??4CLabelsByImageQuery@@QAEAAV0@ABV0@@Z
??4CProtectedQuery@@QAEAAV0@ABV0@@Z
??4CStockQuery@@QAEAAV0@ABV0@@Z
??4ExifTagEntry@@QAEAAU0@ABU0@@Z
??_7AddressObject@@6B@
??_7CAllAddressesQuery@@6B@
??_7CAllTrackingQuery@@6B@
??_7CGetChildLabelsQuery@@6B@
??_7CGetLabelQuery@@6B@
??_7CGetLabelsFromImagesQuery@@6B@
??_7CGetTopLabelsQuery@@6B@
??_7CLabelsByImageQuery@@6B@
??_7CProtectedQuery@@6B@
??_7CStockQuery@@6B@
?Construct@AddressObject@@QAE?AW4SUPPORTS_ERRORS@@V?$shared_ptr@VBinaryInterface@@@boost@@@Z
?GetAsciiType@AddressObject@@UAE?AVSystemString@@XZ
ChainResources
GetFactoryV2

Sections

.text
Size: 104KB - Virtual size: 103KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f84daa86c9759475c469d93eae1e3069

Headers

File Characteristics

PDB Paths

Imports

atlas

shlwapi

vistadb.esx

kpcdinterface

kcor40

vprintonlinehelper40

mfc80

msvcr80

kernel32

user32

advapi32

shell32

ole32

oleaut32

msvcp80

locpcd

Exports

Exports

Sections

.text Size: 104KB - Virtual size: 103KB

.rdata Size: 37KB - Virtual size: 37KB

.data Size: 8KB - Virtual size: 9KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 15KB - Virtual size: 14KB

.text
Size: 104KB - Virtual size: 103KB

.rdata
Size: 37KB - Virtual size: 37KB

.data
Size: 8KB - Virtual size: 9KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 15KB - Virtual size: 14KB