Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Static task
static1
Behavioral task
behavioral1
Sample
e6195002fecd1cd970e80ab5b2318974_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
e6195002fecd1cd970e80ab5b2318974_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
e6195002fecd1cd970e80ab5b2318974_JaffaCakes118
-
Size
23KB
-
MD5
e6195002fecd1cd970e80ab5b2318974
-
SHA1
c40a15e0f8b2e521f0ae481b3339d2893970a178
-
SHA256
bbe0a9199a171bdb993b8882ab6625a34304a2fa8889ff37b7e6b281d699cbe5
-
SHA512
445ca53a48fb6b04ca9f333a9aa9cdd311ee3e6b82a7c60ba168bd2e7525a0066a0dc04462064ebd339b6ba2db3ac3f7fde26cafe6f4484c5d4abafa412d742d
-
SSDEEP
384:TtkAsyopTxyeDSsKR8wFB0M0Ro551Fa+wmG9C41fKV5uakl5kNzIyeqgbueo:aAsJRDSsKRfB0M0Ro55fomGw6fKeaWk9
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e6195002fecd1cd970e80ab5b2318974_JaffaCakes118
Files
-
e6195002fecd1cd970e80ab5b2318974_JaffaCakes118.exe windows:1 windows x86 arch:x86
60d8743856781f22733f8809e83046cd
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
DeleteFileA
ExitProcess
ExpandEnvironmentStringsA
FreeLibrary
GetCommandLineA
GetCurrentProcess
GetExitCodeThread
GetFileAttributesA
GetFileSize
GetFullPathNameA
GetLastError
GetLocaleInfoA
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetProcAddress
GetSystemDefaultLCID
GetSystemDefaultLangID
GetSystemDirectoryA
GetSystemInfo
GetSystemTime
CloseHandle
GetTempPathA
GetVersionExA
LoadLibraryA
CopyFileA
LocalAlloc
LocalFree
ReadFile
CreateEventA
RtlUnwind
RtlZeroMemory
CreateFileA
SetFilePointer
Sleep
UnmapViewOfFile
VerLanguageNameA
VirtualAlloc
VirtualFree
VirtualProtect
WaitForSingleObject
WinExec
WriteFile
lstrcatA
lstrcpyA
lstrlenA
CreateProcessA
CreateSemaphoreA
CreateThread
user32
GetMessageA
TranslateMessage
DispatchMessageA
wsprintfA
DefWindowProcA
advapi32
LookupPrivilegeValueA
OpenProcessToken
AdjustTokenPrivileges
RegCreateKeyA
RegCloseKey
RegFlushKey
RegOpenKeyA
RegOpenKeyExA
RegSetValueExA
crtdll
__GetMainArgs
_sleep
_splitpath
_stricmp
exit
raise
signal
strchr
Sections
.text Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 6KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE